CVE-2026-73760: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

An authenticated Path Traversal vulnerability (CWE-22) exists in HPE AOS-CX that permits an attacker with valid privileges to read arbitrary files on the device's underlying operating system through the web management interface. This vulnerability could expose sensitive information by bypassing intended file access restrictions. The CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official fix or patch has been documented as of the publication date.

Successful exploitation allows an authenticated attacker to read arbitrary files from the underlying OS via the web interface, potentially exposing sensitive information. There is no direct impact on integrity or availability reported. The confidentiality impact is high due to unauthorized file disclosure. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.