CVE-2026-73770: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX allows an authenticated malicious actor, under specific conditions outside their control and following a required action by another user, to write arbitrary files and execute arbitrary commands as a privileged user on the underlying OS. The flaw is categorized under CWE-73 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 vector indicates the attack requires adjacent network access, high attack complexity, high privileges, and user interaction, with impacts rated high on confidentiality, integrity, and availability.

If exploited, an attacker with valid authentication could gain the ability to write arbitrary files and execute commands with privileged OS rights, potentially leading to full system compromise. This could impact confidentiality, integrity, and availability of the affected system. However, exploitation requires specific conditions involving another user's action, which may limit the attacker's control.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AOS-CX versions to trusted users only and monitor for unusual activity consistent with arbitrary file writes or command execution attempts.