CVE-2026-73758: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability exists in the API endpoint of HPE AOS-CX, where an authenticated user with low privilege can escalate their privileges to change certain system settings. The CVSS 3.1 score is 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, required privileges are low, no user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. There is no indication of known exploits in the wild or available patches.

An authenticated low privilege operator can change certain system settings, potentially leading to unauthorized configuration changes that affect system integrity. There is no impact on confidentiality or availability. No known active exploitation has been reported.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoint to trusted users only and monitor for suspicious privilege escalation attempts.