CVE-2026-73766: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

The vulnerability CVE-2026-73766 in HPE AOS-CX involves command injection in the API endpoint. An attacker who is authenticated and has administrative privileges can exploit this flaw to execute arbitrary commands with privileged access on the underlying OS. This could lead to full system compromise depending on the commands executed. The vulnerability is identified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The affected versions are explicitly listed as 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no vendor advisory or patch links are currently available.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise including unauthorized data access, modification, or denial of service. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor HPE advisories for updates. Until a fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit exposure of the API endpoint.