CVE-2026-73772: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability involves buffer overflow issues in a service underlying HPE AOS-CX. An attacker can trigger a denial-of-service (DoS) condition without authentication by sending crafted packets to the affected device. The impact is limited to availability disruption, causing the operating system to malfunction. The CVSS 3.1 vector indicates the attack requires adjacent network access, no privileges, and no user interaction. Confidentiality and integrity are not affected. The affected versions include specific releases of AOS-CX: 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

Successful exploitation results in denial-of-service by disrupting normal operation of the underlying operating system on affected HPE AOS-CX devices. There is no impact on confidentiality or integrity. The attack can be performed without authentication but requires adjacent network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected devices to trusted networks and monitor for unusual traffic patterns that may indicate attempts to exploit this vulnerability.