CVE-2026-73767: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability (CVE-2026-73767) exists in the command line interface of HPE AOS-CX, where authenticated users with high privileges can perform command injection, enabling arbitrary command execution on the underlying OS. The issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. There is no vendor advisory or patch information provided, and no known exploits have been reported in the wild.

Successful exploitation allows an authenticated privileged user to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The high CVSS score reflects the significant impact and ease of exploitation given the required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the command line interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the CLI to untrusted networks.