Aruba AOS EUVD-2026-29815

Exploitation requires an authenticated session with HIGH privileges (CVSS PR:H) on the web-based management interface of an affected AOS-8 or AOS-10 device - i.e., the attacker must already be a privileged/administrative management user, not an anonymous network client. The specific attack surface is the web-based management interface command-processing path (CWE-77 command injection). Limiting factors that reduce realistic risk: the requirement for prior high-privilege authentication, the need for network reachability to the management interface (which is frequently isolated to a management VLAN), and applicability only to the listed AOS versions (AOS-8 8.10.x/8.12.x/8.13.x and AOS-10 10.4.x/10.7.x/10.8.0.0). No user interaction is required (UI:N) once authenticated. There is no indication of active exploitation (SSVC Exploitation=none, no KEV).

The signals are internally consistent and point to a real-but-gated risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) shows network reachability and low complexity but requires HIGH privileges (PR:H) - the attacker must already be an authenticated, privileged management user - which is the primary factor holding severity below critical. This aligns with SSVC: Exploitation=none, Automatable=no, Technical Impact=total. EPSS is low at 0.18% (39th percentile), and there is no CISA KEV listing and no public exploit identified, so this is not currently being weaponized. The dominant real-world risk is post-authentication privilege abuse: a compromised or malicious admin credential (or a chained lower-privilege bug) converts management access into full OS code execution. No signals conflict here - network vector plus PR:H plus 'total' technical impact coherently describe an authenticated admin-interface command injection. Prioritize patching where management interfaces are broadly reachable, but this is not a drop-everything unauthenticated RCE.

An attacker who has obtained privileged administrator credentials for an Aruba controller - via phishing, credential reuse, or a chained lower-privilege flaw - logs into the web-based management interface and submits a crafted value into a vulnerable configuration field that is passed to an OS command. The injected command executes on the underlying appliance OS with full technical impact, letting the attacker plant an implant, pivot into the managed wireless network, or tamper with device configuration. No public proof-of-concept is currently identified, and the low CVSS attack complexity (AC:L) means that once authenticated the injection itself is straightforward.