CVE-2026-73758: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX affects the API endpoint, enabling an authenticated user with low privilege operator rights to escalate privileges by modifying the state of certain system settings. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges at low level, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. No vendor advisory or patch links are provided, and remediation level is unknown.

Successful exploitation allows an authenticated low privilege operator to change the state of certain settings, impacting system integrity. There is no confidentiality or availability impact reported. This could lead to unauthorized configuration changes within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, monitor vendor communications for updates. Restrict access to the API endpoint to trusted users and consider limiting operator privileges until a fix is available.