CVE-2026-73770

Analyzed Analyzed - Analysis Complete

Authenticated Arbitrary File Write in HPE AOS-CX

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73770

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This is an authenticated arbitrary file write vulnerability in AOS-CX. It allows an authenticated attacker, under specific conditions outside their control and requiring another user to take an action, to create or modify files and execute commands as a privileged user on the operating system.

Impact Analysis

An attacker could gain control over the system by writing malicious files or executing commands with high privileges. This could lead to data theft, system compromise, or disruption of services if exploited successfully.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Apply vendor-provided patches or updates for AOS-CX immediately. Restrict user permissions to minimize access. Monitor system logs for suspicious file creation or command execution activities.

Hi! I’m here to help you understand CVE-2026-73770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70