CVE-2026-73781: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability exists in the web-based management interface of HPE AOS-CX, where an authenticated remote attacker can inject stored malicious scripts that execute in the context of an administrative user's browser. Successful exploitation enables arbitrary script execution, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope change with high impact on confidentiality, integrity, and availability.

An attacker who is authenticated to the management interface can conduct a stored XSS attack against an administrative user, leading to arbitrary script execution in the administrator's browser context. This can result in compromise of administrative credentials, session hijacking, or other malicious actions impacting the management interface and underlying system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the management interface to trusted users and networks, and ensure administrators are aware of the risk of interacting with untrusted content within the interface.