CVE-2026-73752

Received Received - Intake

Unauthenticated Arbitrary File Write in HPE AOS-CX

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-73752

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-cx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated arbitrary file write flaw in an API endpoint of AOS-CX. It allows attackers to write arbitrary files to the underlying operating system without authentication.

Impact Analysis

Exploitation could lead to remote code execution, allowing attackers to gain control over the affected system. This may result in data theft, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized file writes and potential remote code execution, which may result in unauthorized access to sensitive data. This could violate compliance requirements under GDPR (data protection) and HIPAA (health information confidentiality) by exposing personal or protected health information.

Mitigation Strategies

Apply vendor patches or updates for AOS-CX immediately. Restrict network access to the vulnerable API endpoint. Monitor system logs for unauthorized file writes or suspicious activity. Consider disabling the affected API endpoint if not required.

Hi! I’m here to help you understand CVE-2026-73752. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70