CVE-2026-73766

Analyzed Analyzed - Analysis Complete

Command Injection in HPE AOS-CX API

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73766

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in the API endpoint of AOS-CX. An authenticated remote attacker with administrative privileges can inject arbitrary commands. If exploited, it allows running arbitrary commands as a privileged user on the underlying operating system.

Detection Guidance

This vulnerability requires authenticated administrative access to exploit. Detection should focus on monitoring API endpoint interactions for unusual command injection patterns. Check logs for suspicious input in API requests, such as semicolons, pipes, or command substitution characters. Review system logs for unexpected command executions by privileged users.

Impact Analysis

An attacker could gain full control over the system by executing arbitrary commands with high privileges. This could lead to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Immediately restrict administrative access to the API endpoint and apply vendor patches if available. Monitor network traffic for suspicious API requests and disable the affected endpoint if exploitation is suspected.

Hi! I’m here to help you understand CVE-2026-73766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70