CVE-2026-73765: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability (CVE-2026-73765) in HPE AOS-CX involves authenticated path traversal in API endpoints, enabling an attacker with high privileges to write arbitrary files to the OS. This can lead to remote code execution. The affected versions explicitly include =10.10.0000, =10.13.0000, =10.16.0000, =10.17.0000, and =10.18.0000. The CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation allows an authenticated attacker with high privileges to write arbitrary files on the underlying operating system, which can lead to remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted administrators only and monitor for suspicious activity. Avoid exposing management interfaces to untrusted networks.