CVE-2026-73758

Received Received - Intake

Privilege Escalation in HPE ArubaOS-CX API

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-73758

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-cx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in the API endpoint of AOS-CX. An authenticated low privilege operator user could exploit it to change certain system settings.

Impact Analysis

An attacker with low privileges could gain unauthorized control over system settings, potentially disrupting operations or enabling further attacks.

Compliance Impact

This vulnerability allows an authenticated low privilege operator to change system settings, which could lead to unauthorized modifications affecting data integrity or access controls. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized changes to system configurations that protect sensitive data.

Mitigation Strategies

Apply vendor patches or updates for AOS-CX to address the privilege escalation vulnerability. Restrict API endpoint access to authorized users only and monitor for unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-73758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70