CVE-2026-73781

Analyzed Analyzed - Analysis Complete

Stored XSS in HPE ArubaOS-CX Web Management Interface

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-21

NVD

CVE-2026-73781

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the web-based management interface of AOS-CX. It allows an authenticated remote attacker to inject malicious scripts that are stored on the server and executed in the browser of an administrative user when they access the affected interface.

Detection Guidance

This vulnerability involves a stored XSS attack in the AOS-CX web-based management interface. Detection requires manual inspection of the interface for malicious script injection in user inputs, configuration fields, or stored data. Check for unusual script tags or event handlers in web forms, URL parameters, or saved configurations. No specific commands are provided for automated detection.

Impact Analysis

An attacker could exploit this to execute arbitrary script code in your browser within the context of the AOS-CX interface. This could lead to session hijacking, unauthorized actions, or theft of sensitive data if you are an administrative user.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in a victim's browser. This may lead to data breaches, unauthorized access to sensitive information, or manipulation of user sessions, which are critical violations under these regulations.

Mitigation Strategies

Update AOS-CX to the latest patched version to address the stored XSS vulnerability. Restrict access to the web-based management interface to trusted administrative users only. Monitor network traffic for suspicious activity related to the interface.

Hi! I’m here to help you understand CVE-2026-73781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70