CVE-2026-73782

Analyzed Analyzed - Analysis Complete

Format String Vulnerability in HPE AOS-CX CLI Leads to RCE

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-10

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-09

NVD

CVE-2026-73782

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This is a format string vulnerability in the command line interface of AOS-CX. It allows unauthenticated remote code execution, meaning attackers can run arbitrary commands with high privileges on the affected system.

Detection Guidance

Since this is a format string vulnerability in AOS-CX CLI, detection requires checking for unusual command execution patterns or network traffic involving the affected interface. Monitor logs for unexpected privileged commands or remote code execution attempts. No specific commands are provided in the available context.

Impact Analysis

An attacker could exploit this to gain full control over the system, steal data, install malware, or disrupt operations. Since it requires no authentication, the risk is high for any exposed AOS-CX interfaces.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data security). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply vendor patches or updates for AOS-CX immediately to address the format string vulnerability. Isolate affected systems from untrusted networks until patched. Monitor network traffic for suspicious command line activity or unauthorized code execution attempts.

Hi! I’m here to help you understand CVE-2026-73782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70