A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle… (CVE-2026-73756)

The vulnerability in AOS-CX involves an API endpoint susceptible to man-in-the-middle attacks by remote unauthenticated attackers. Successful exploitation enables the attacker to retrieve sensitive information, potentially compromising confidentiality. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker can remotely intercept and obtain sensitive information from the affected API endpoint without authentication, which could lead to further confidentiality compromises of the system. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided at this time.