CVE-2026-73770: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX allows an authenticated attacker, under certain conditions outside their control and requiring another user's action, to write arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system. The attack vector requires network access with high privileges and user interaction. The CVSS 3.1 score is 7.3, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-73 (External Control of File Name or Path). No patch or official remediation level has been published by HPE as of the data provided.

If exploited, an authenticated attacker could gain the ability to create or modify arbitrary files and execute commands with privileged OS user rights, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. However, exploitation requires specific conditions and user interaction, limiting the attacker's control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AOS-CX versions to trusted users only and monitor for suspicious activity involving file modifications or command executions. Follow any future vendor recommendations promptly.