CVE-2026-73775

Received Received - Intake

Authenticated Information Disclosure in HPE AOS-CX

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-CX.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-73775

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-cx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in AOS-CX's API endpoint allows a remote attacker with low-level authentication to access sensitive information. Exploitation could provide data enabling further access to network services supported by AOS-CX.

Impact Analysis

An attacker could retrieve sensitive data, potentially leading to unauthorized access to network services. This may compromise system integrity or enable lateral movement within affected networks.

Compliance Impact

This vulnerability could allow unauthorized access to sensitive information, which may violate data protection requirements under GDPR and HIPAA. Exposure of such data could lead to non-compliance with confidentiality and security controls mandated by these regulations.

Mitigation Strategies

Apply vendor patches or updates for AOS-CX to address the API endpoint vulnerabilities. Restrict API access to authorized users only and monitor network traffic for suspicious activity targeting AOS-CX services.

Hi! I’m here to help you understand CVE-2026-73775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70