CVE-2026-73757

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in HPE AOS-CX

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-13

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-12

NVD

CVE-2026-73757

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) issue in the web-based management interface of AOS-CX. An authenticated remote attacker can exploit it to send crafted requests from the vulnerable server to internal systems, allowing them to gather details about the internal network structure of the AOS-CX host. This could lead to unauthorized access to sensitive information or limited modification of data.

Detection Guidance

Detecting SSRF vulnerabilities typically involves monitoring network traffic and application behavior. Check for unusual internal network requests originating from the AOS-CX web interface. Inspect server logs for outbound connections to internal or unexpected external addresses. Use tools like curl to test if the interface allows fetching internal resources or sensitive data.

Impact Analysis

If you are an administrator or user of AOS-CX, this vulnerability could allow attackers to map your internal network, access sensitive data, or make unauthorized changes to configurations. Even with limited privileges, an attacker might extract internal system details or manipulate data, posing risks to confidentiality and integrity.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data exposure or modification, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Organizations might face penalties if sensitive data is compromised due to inadequate protection against such attacks.

Mitigation Strategies

Implement strict input validation for all web interface requests. Restrict access to the management interface to trusted networks or IP addresses. Apply patches or updates provided by HPE as soon as they become available.

Hi! I’m here to help you understand CVE-2026-73757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70