CVE-2026-73762

Analyzed Analyzed - Analysis Complete

AOS-CX API Access Control Bypass Vulnerability

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-10

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-09

NVD

CVE-2026-73762

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in the API endpoint of AOS-CX, allowing a remote attacker to bypass access controls. This could grant unauthorized access to management functions that should be restricted by configured policies.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive management features, potentially leading to data breaches, system manipulation, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately review and update access control policies for AOS-CX API endpoints to ensure proper restrictions are in place. Monitor network traffic for unauthorized access attempts to management interfaces and apply vendor patches or updates as soon as they become available.

Hi! I’m here to help you understand CVE-2026-73762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70