CVE-2026-73780: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX
Description
CVE-2026-73780 is a high-severity vulnerability in the web-based management interface of Hewlett Packard Enterprise (HPE) AOS-CX switches. The issue arises from a lack of Cross-Site Request Forgery (CSRF) protection on some sessions, which could allow a remote unauthenticated attacker to execute arbitrary input if an authenticated user interacts with a crafted URL. The vulnerability affects specific versions of AOS-CX and has a CVSS score of 8.3, indicating significant impact on confidentiality, integrity, and availability.
CVSS v3.1
Score 8.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in HPE AOS-CX switches' web management interface involves missing CSRF protections on certain sessions. An attacker who can trick an authenticated user into visiting a malicious URL may cause arbitrary commands to be executed on the interface. The vulnerability affects versions 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000 of AOS-CX. The CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting high impact but requiring user interaction and high attack complexity.
Potential Impact
Successful exploitation could lead to full compromise of the affected switch's management interface, impacting confidentiality, integrity, and availability. Because the attack requires user interaction (an authenticated user clicking a crafted URL) and has high attack complexity, exploitation is not trivial but could result in significant control over the device.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs received in management sessions and restrict access to the management interface to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8gh4-xffv-m8cw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73780"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a984576acd9273b496ad75a
Added to database: 09/02/2026, 15:49:10 UTC
Last enriched: 09/07/2026, 19:53:06 UTC
Last updated: 10/18/2026, 06:48:19 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.