A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request… (CVE-2026-73757)

This vulnerability affects the web-based management interface of AOS-CX. An authenticated remote attacker can exploit a server-side request forgery (SSRF) flaw to gather information about the internal structure of the AOS-CX host. Successful exploitation may lead to limited disclosure and modification of sensitive data. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact without availability impact. No affected versions or patch information are provided in the available data.

An attacker with valid authentication can leverage SSRF to enumerate internal host details and cause limited disclosure and modification of sensitive information on the AOS-CX device. There is no indication of availability impact or broader system compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Until a patch is available, restrict authenticated access to the management interface to trusted users only.