CVE-2026-73755: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX affects the API endpoint, enabling an authenticated low-privilege operator user to escalate privileges to access sensitive information after a required user interaction. The vulnerability is identified as CWE-269 (Improper Privilege Management). It has a CVSS 3.1 base score of 5.7 (medium severity), with attack vector network, low attack complexity, privileges required low, user interaction required, scope unchanged, and high confidentiality impact. No known exploits are reported in the wild. The affected versions explicitly include =10.10.0000, =10.13.0000, =10.16.0000, =10.17.0000, and =10.18.0000. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated low-privilege operator user to gain unauthorized access to sensitive information on the vulnerable system. There is no impact on system integrity or availability. The confidentiality impact is high, but integrity and availability impacts are none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the API endpoint to trusted users and monitor for suspicious activity involving low-privilege operator accounts. Avoid granting unnecessary privileges to operator users.