CVE-2026-73781

Received Received - Intake

Stored XSS in HPE ArubaOS-CX Web Management Interface

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-73781

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-cx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the web-based management interface of AOS-CX. It allows an authenticated remote attacker to inject malicious scripts that are stored on the server and executed in the browser of an administrative user when they access the affected interface.

Impact Analysis

An attacker could exploit this to execute arbitrary script code in your browser within the context of the AOS-CX interface. This could lead to session hijacking, unauthorized actions, or theft of sensitive data if you are an administrative user.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in a victim's browser. This may lead to data breaches, unauthorized access to sensitive information, or manipulation of user sessions, which are critical violations under these regulations.

Mitigation Strategies

Update AOS-CX to the latest patched version to address the stored XSS vulnerability. Restrict access to the web-based management interface to trusted administrative users only. Monitor network traffic for suspicious activity related to the interface.

Hi! I’m here to help you understand CVE-2026-73781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70