CVE-2026-73767: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

CVE-2026-73767 describes authenticated command injection vulnerabilities in the command line interface of HPE AOS-CX. Successful exploitation enables arbitrary command execution with privileged user rights on the underlying OS. The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions are explicitly listed as =10.10.0000, =10.13.0000, =10.16.0000, =10.17.0000, and =10.18.0000. No vendor advisory or patch information is currently available, and the product is not a cloud service. No known exploitation in the wild has been reported.

An attacker with authenticated privileged access to the AOS-CX command line interface can execute arbitrary commands on the underlying operating system. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged CLI access to trusted administrators only and monitor for suspicious command activity.