CVE-2026-73782

Received Received - Intake

Format String Vulnerability in HPE AOS-CX CLI Leads to RCE

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-73782

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-cx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a format string vulnerability in the command line interface of AOS-CX. It allows unauthenticated remote code execution, meaning attackers can run arbitrary commands with high privileges on the affected system.

Impact Analysis

An attacker could exploit this to gain full control over the system, steal data, install malware, or disrupt operations. Since it requires no authentication, the risk is high for any exposed AOS-CX interfaces.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data security). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply vendor patches or updates for AOS-CX immediately to address the format string vulnerability. Isolate affected systems from untrusted networks until patched. Monitor network traffic for suspicious command line activity or unauthorized code execution attempts.

Hi! I’m here to help you understand CVE-2026-73782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70