CVE-2026-73756: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX arises from an API endpoint susceptible to interception via man-in-the-middle attacks by remote unauthenticated attackers. Exploitation enables the attacker to retrieve sensitive information, potentially compromising the confidentiality of the affected system. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. The affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated remote attacker to obtain sensitive information via a man-in-the-middle attack, compromising the confidentiality of the affected system. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider minimizing exposure of the vulnerable API endpoint to untrusted networks and employing network-level protections such as encryption and secure communication channels to reduce the risk of man-in-the-middle attacks.