Remote denial of service in protobuf.js (npm package) allows unauthenticated attackers to crash Node.js processes by sending crafted protobuf payloads with deeply nested structures. The vulnerability affects the binary decoding path where unbounded recursion exhausts the JavaScript call stack. Version 7.5.6 and 8.0.2 patches are available. Applications decoding untrusted protobuf data over network APIs, message queues, or file uploads are at immediate risk. CVSS 7.5 (High) reflects network attack vector with no authentication required.
Arbitrary file read in the esm.sh CDN build server (Go implementation, versions ≤ 137) lets a remote attacker exfiltrate sensitive host files by publishing a malicious npm package. The esbuild plugin re-maps module paths using the package.json 'browser' field without re-validating the sandbox, so '../' sequences escape the package directory and file contents are returned inside the bundled JS and source-map sourcesContent. A working PoC exists (published npm package chess-sec-utils1) reading /etc/hostname, /etc/os-release and /etc/environment, but there is no public exploit identified as actively used and EPSS risk is low (0.04%).
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who holds any single valid digest response replay it to reach a different protected endpoint, defeating per-resource access control. The flaw is CWE-287 (improper authentication) because the server trusts the URI value inside the client's Authorization header instead of binding the hash to the actually-requested resource. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC marks exploitation as none but automatable.
Denial of service in multiparty (Node.js multipart/form-data parser) versions ≤4.2.3 crashes Node.js processes when attackers send crafted form uploads with field names matching JavaScript Object prototype properties (__proto__, constructor, toString). CVSS 7.5 (High) with network vector and no authentication required. No public exploit code identified at time of analysis, but exploitation is trivial given the straightforward prototype pollution attack pattern. Services accepting file uploads via multiparty are immediately affected until upgraded to 4.3.0+.
Remote denial of service in Deskflow servers (versions prior to 1.26.0.167) running with TLS enabled - the default - lets any unauthenticated TCP peer stall input delivery to all connected screens. Because SecureSocket::secureAccept calls a blocking Arch::sleep(1) on the single multiplexer worker thread whenever a connection's first bytes fail to parse as a valid TLS ClientHello, one malformed handshake freezes mouse, keyboard, and clipboard traffic for ~1 second, and a sustained drip of ≥1 bad connection per second renders the server unusable. EPSS is low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis, though the fix commit is public and the trigger is trivial.
Uncontrolled resource consumption in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker exhaust system resources and force an application-level denial-of-service without any authentication or user interaction. The flaw carries a CVSS 7.5 (availability-only) rating and, per Adobe's APSB26-49 advisory, affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Denial of service crashes multiparty Node.js parser versions ≤4.2.3 when processing malformed percent-encoded filename* parameters in multipart/form-data uploads. Attackers can remotely crash any Node.js service using vulnerable multiparty versions by sending a single crafted HTTP request with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, but exploitation is trivial given the straightforward attack vector. Vendor-released patch: multiparty@4.3.0.
Denial-of-service in Adobe Commerce (Magento) 2.4.4-p17, 2.4.5-p16, 2.4.6-p14, 2.4.7-p9, 2.4.8-p4, 2.4.9-beta1 and earlier allows a remote attacker to exhaust system resources and render the application unavailable without any authentication or user interaction. The flaw is an Uncontrolled Resource Consumption (CWE-400) issue reported by Adobe (APSB26-49); it carries a CVSS 7.5 (availability-only impact) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), indicating no observed weaponization to date.
Regular expression denial of service in multiparty (npm package) versions 4.2.3 and below allows remote unauthenticated attackers to block the Node.js event loop for seconds via crafted Content-Disposition headers in multipart uploads. The vulnerability triggers catastrophic backtracking in the filename parameter parser with headers as small as 8 KB. Fixed in multiparty 4.3.0. EPSS data not available; no active exploitation confirmed at time of analysis, but the low complexity (AV:N/AC:L/PR:N/UI:N) and availability of detailed public advisory increase weaponization risk for any web service accepting file uploads through this library.
Complete process crash in Dalfox REST server v2.12.0 and earlier allows remote unauthenticated attackers to terminate the entire scan engine via a single HTTP request. The flaw stems from a closed-channel write panic in pkg/scanning/parameterAnalysis.go where two sequential worker stages share a single results channel, causing a Go runtime panic when the second stage attempts to write to the already-closed channel. Default deployments run without authentication (no --api-key), making the vulnerability remotely exploitable. CVSS 7.5 (High). Patched in v2.13.0 per GitHub advisory GHSA-2g4x-fq3j-cgq4. No CISA KEV listing or public exploit code identified at time of analysis.
Remote unauthenticated attackers can access confidential data from other users' chat sessions in Spring AI applications due to insecure default configuration in the chat memory component. The vulnerability allows network-based exploitation with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and impacts confidentiality only (C:H/I:N/A:N), enabling cross-user data leakage in multi-tenant AI chat implementations. Reported by VMware, affecting Java-based Spring AI deployments where developers have not explicitly configured chat memory isolation.
Sensitive user data disclosure in Apple iOS and iPadOS before 18.7.3 and before 26.2 stems from an inconsistent user-interface state that allows a malicious or crafted app to access data it should not. The flaw, reported by Apple's own product security team and fixed across the iOS 18.7.x and 26.x branches, carries a CVSS of 7.5 (high confidentiality impact) but an EPSS of just 0.03%, and there is no public exploit identified at time of analysis. CISA SSVC rates exploitation as none, indicating a real but low-urgency issue rather than an actively targeted one.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service (CWE-20, insufficient input validation). Reported by HPE with no public exploit identified at time of analysis; EPSS is very low (0.03%, 9th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable. Impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service. Because input validation is insufficient, a successful attack terminates the process and disrupts wireless network operations without affecting confidentiality or integrity. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), indicating no observed exploitation activity.
Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout tracking because usernames are compared with inconsistent case sensitivity (CWE-178), enabling authentication-related information leakage across Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The CVSS 3.1 vector (7.5, C:H only) scopes the impact to confidentiality with no integrity or availability effect, consistent with the 'Information Disclosure' tagging. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%, 5th percentile), and CISA SSVC records exploitation as none.
Denial of service in Apache Tomcat 9.x, 10.1.x, and 11.0.x allows remote unauthenticated attackers to exhaust server resources due to missing limits or throttling on a resource allocation path (CWE-770). Affected versions span 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, and 9.0.0.M1 through 9.0.117, with older unsupported branches also implicated per the EUVD entry. No public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), but the SSVC framework flags the issue as automatable with partial technical impact.
SQL injection in the Elixir postgrex library allows local attackers with control over PostgreSQL LISTEN/UNLISTEN channel names to execute arbitrary SQL commands including DDL and DML operations. The Postgrex.Notifications module (versions 0.16.0 through 0.22.1) fails to escape double-quote characters in channel arguments, enabling attackers to break out of quoted identifiers and chain multi-statement payloads such as DROP TABLE commands. Vendor patch available in version 0.22.2 per GitHub advisory GHSA-r73h-97w8-m54h. No public exploit code or CISA KEV listing identified at time of analysis, though the technical details and patch diff are publicly disclosed.
Session persistence after credential change in SillyTavern before 1.18.0 lets an attacker holding a stolen session cookie retain full account access even after the victim resets their password. Because sessions are stateless and stored entirely in a signed client-side cookie with a default 400-day lifespan, the change-password and account-recovery endpoints update the password hash but never revoke outstanding tokens, defeating the standard remediation for cookie theft. No active exploitation is recorded (not in CISA KEV) and EPSS is very low at 0.02%, but public proof-of-concept reproduction steps are documented in the GHSA advisory.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an unauthenticated remote attacker can trigger uncontrolled resource consumption (CWE-400) to exhaust system resources without any user interaction. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.01%, 2nd percentile), so while the CVSS availability impact is High (7.5), real-world weaponization appears unlikely in the near term. Impact is limited to availability, with no confidentiality or integrity effect.
Application denial-of-service in Adobe Commerce (Magento) affects versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier, where an Uncontrolled Resource Consumption flaw (CWE-400) lets a remote, unauthenticated attacker exhaust server resources without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a high availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 2nd percentile), indicating minimal observed exploitation interest despite the network-reachable attack surface.
Uncontrolled resource consumption in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK versions 0.78.2, 0.7.0 and earlier lets a remote unauthenticated attacker exhaust system resources and crash the application (availability-only denial-of-service). No public exploit is identified at time of analysis and EPSS probability is negligible (0.01%), but SSVC flags the attack as automatable, so exploitation could be scripted once a vector is understood. Confidentiality and integrity are not impacted.
Unauthenticated arbitrary file read in dalfox REST API server mode allows remote attackers to exfiltrate sensitive files from the host filesystem. The vulnerability chains two flaws: missing authentication middleware when no API key is set (default configuration), and unsanitized deserialization of the `custom-payload-file` JSON parameter directly into the scan engine. Remote attackers can supply any file path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, cloud credential files) and the engine reads each line, embeds it as an XSS payload, and transmits it to an attacker-controlled HTTP endpoint via dalfox's own scan traffic. No exploit code is publicly identified at time of analysis; vendor-released patch available in version 2.13.0.
Prototype pollution in protobufjs allows denial of service through corrupted JavaScript built-ins when parsing untrusted schemas. Attackers who control protobuf schemas or JSON descriptors can write to inherited object properties on global constructors, causing process-wide state corruption that persists until restart. CVSS 7.5 (High) with network vector and no authentication required, but real-world risk is limited to applications parsing schemas from untrusted sources-applications only decoding untrusted message payloads with trusted schemas are not affected. Vendor-released patches available: v7.5.6 and v8.0.2. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Server-Side Request Forgery in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote attacker bypass security controls and gain unauthorized read access by luring a victim to a maliciously crafted URL or compromised page. Rated CVSS 7.4 with a scope-changed impact, the flaw affects the e-commerce platform's server-side request handling. There is no public exploit identified at time of analysis, and EPSS is low (0.13%, 32nd percentile), so exploitation is currently theoretical rather than observed.
Information disclosure in Microsoft Edge (Chromium-based) before 148.0.3967.55 allows a remote, unauthenticated attacker to read data they should not have access to by luring a victim into interacting with malicious web content. Rooted in external control of a file name or path (CWE-73) with a changed CVSS scope, it can leak sensitive information across security boundaries. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Remote code execution in Ivanti Virtual Traffic Manager allows authenticated administrators to execute arbitrary OS commands via command injection. Affects all versions before 22.9r4. Attack requires network access and administrative credentials but has low complexity (CVSS AC:L). No active exploitation confirmed at time of analysis, though administrative access requirement significantly limits attack surface compared to unauthenticated RCE vulnerabilities.
Information disclosure in Apache Tomcat versions 7.0.83 through 11.0.21 exposes HTTP authentication headers to unintended hosts during WebSocket authentication handshakes, enabling credential leakage to third-party endpoints. The flaw carries a CVSS 7.3 score with partial confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. EPSS probability is very low (0.03%) but SSVC marks the issue as automatable, indicating that scripted exploitation is feasible if attacker positioning is achieved.
Memory corruption in Mozilla Firefox's WebAssembly JavaScript engine component allows remote attackers to trigger a use-after-free condition via crafted web content, with limited impact across confidentiality, integrity, and availability. The flaw affects Firefox versions prior to 150.0.3 and has no public exploit identified at time of analysis, though SSVC indicates the issue is automatable. EPSS scoring (0.02%, 5th percentile) suggests very low near-term exploitation probability despite the network-reachable attack vector.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Stack-based buffer overflow in Siemens Solid Edge SE2026 allows arbitrary code execution when users open malicious PAR files. Attackers must deliver a weaponized PAR file and convince the user to open it, after which code executes with user's privileges. All versions prior to V226.0 Update 5 are vulnerable. No active exploitation confirmed (not in CISA KEV), but the attack relies on user interaction with a common CAD file format, making social engineering feasible in engineering/manufacturing environments.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker holding high privileges to upload arbitrary files to the underlying OS, potentially escalating to remote code execution as a privileged user. Multiple 8.x and 10.x branches are affected across mobility controllers/gateways running these AOS versions. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and SSVC lists exploitation status as none, indicating no observed exploitation to date.
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an authenticated, high-privileged remote attacker upload arbitrary files to the underlying OS, escalating to remote code execution as a privileged user. It affects multiple 8.x and 10.x controller/gateway branches and is fixed via the HPE security bulletin (hpesbnw05048en_us). There is no public exploit identified at time of analysis, and EPSS probability is low (0.26%), consistent with the CISA SSVC assessment of no known exploitation.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.
Remote code execution in Claris FileMaker Cloud allows authenticated administrators to execute arbitrary operating system commands via command injection in the External ODBC Data Source connection test feature. The vulnerability requires Admin Console privileges (PR:H) but no user interaction, enabling complete system compromise with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis. EPSS score of 0.23% (46th percentile) indicates low observed exploitation probability despite the RCE capability. Fixed in FileMaker Cloud version 2.22.0.5.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privileged remote attacker break out of the CLI service reached over the PAPI protocol and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (high) with total technical impact, but there is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none and non-automatable. EPSS is low at 0.19% (41st percentile), consistent with the high-privilege prerequisite limiting opportunistic mass exploitation.
Authenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and above) lets a high-privileged remote operator break out of the CLI and run arbitrary operating-system commands on the underlying AP. HPE self-reported the flaw (CWE-77) with a CVSS 7.2 rating and total technical impact per CISA SSVC, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.19% (40th percentile) exploitation probability. Notably, AOS-10.4 APs and the AOS-8 Instant branch are explicitly not affected, narrowing the exposed fleet.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with high privileges (PR:H) execute arbitrary OS commands on the underlying controller/gateway, yielding full compromise of the wireless infrastructure device. Affected trains include AOS 8.10.x/8.12.x/8.13.x and 10.4.x/10.7.x/10.8.0. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none; EPSS is low at 0.18% (39th percentile).
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems (CVE-2026-44868, CWE-77) lets a high-privileged remote attacker execute arbitrary OS commands on the underlying controller/gateway. HPE self-reported the flaw; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the low EPSS (0.18%, 39th percentile) reflects no observed exploitation. The primary risk is a privileged operator or a hijacked admin session escaping the constrained management CLI/UI to full root-level control of the network infrastructure device.
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privileged remote user run arbitrary operating-system commands through the web-based management interface (CWE-77). Affected devices include Aruba mobility controllers and gateways running vulnerable AOS-8 and AOS-10 builds; the CVSS 3.1 base score is 7.2 (PR:H). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records no known exploitation, so this is a hardening priority rather than an active threat.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privilege remote administrator break out of the intended CLI/GUI context and run arbitrary OS commands on the underlying controller/gateway. Multiple 8.x and 10.x branches are affected, giving full confidentiality, integrity, and availability impact (total technical impact per SSVC). There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the flaw is not listed in CISA KEV, so it currently represents a patch-on-schedule rather than emergency issue.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.
Authenticated administrators with Admin Console access to FileMaker Cloud can execute arbitrary operating system commands on the underlying host by bypassing front-end restrictions on OS Script schedule types. This vulnerability affects all FileMaker Cloud versions prior to 2.22.0.5 and requires high-privilege administrative credentials to exploit. Despite the network attack vector and total technical impact (full system compromise), the low EPSS score (0.13%, 32nd percentile) and SSVC assessment indicating no observed exploitation suggest this is not being actively exploited in the wild, likely due to the high privilege requirement limiting the attacker pool to malicious insiders or compromised admin accounts.
Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privilege remote attacker to execute arbitrary system commands on the underlying operating system via flawed configuration-processing logic (CWE-78). Affected releases include AOS-10.4.x, 10.7.x, and 10.8.0.0; AOS-8 Instant software is explicitly not affected. There is no public exploit identified at time of analysis, and SSVC reflects no known exploitation with a low EPSS of 0.12%, though technical impact is rated total.
Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on Aruba Access Points running AOS-10 and AOS-8 Instant to break out of the restricted CLI shell and run arbitrary commands on the underlying operating system. HPE, the reporting vendor, classifies the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is low (0.12%), consistent with the CISA SSVC assessment of no known exploitation.
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Stored XSS in LifePress WordPress plugin allows unauthenticated remote attackers to inject malicious scripts that execute in administrator contexts when viewing the plugin's settings page. The vulnerability affects all versions through 2.2.2 and stems from a publicly-accessible AJAX endpoint (lp_update_mds) that lacks both nonce verification and capability checks, combined with improper input sanitization of the 'n' parameter. The CVSS score of 7.2 reflects network-based exploitation requiring no authentication or user interaction, with changed scope enabling cross-context attacks. EPSS and KEV data not available; exploitation probability depends on attacker knowledge of the specific AJAX action endpoint.
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Privilege-to-OS remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10), where several CLI-accessible management service components contain stack-based buffer overflows (CWE-121). An authenticated administrator can send specially crafted requests to these services to execute arbitrary code with elevated privileges on the underlying OS, escaping the constrained management context. There is no public exploit identified at time of analysis, EPSS is very low (0.07%, 22nd percentile), and it is not listed in CISA KEV.