CVE-2026-73773: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

An unauthenticated Denial-of-Service vulnerability (CWE-400) exists in the API endpoint of HPE AOS-CX. Successful exploitation allows an attacker to interrupt service availability without requiring authentication. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges or user interaction needed, and impact limited to availability. The affected versions are explicitly listed as 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. No patch or official remediation guidance is currently available from HPE. The vulnerability is not related to a cloud service and no known active exploitation has been observed.

The impact of this vulnerability is a denial-of-service condition that disrupts the normal operation of the affected AOS-CX service. This can lead to service unavailability, potentially affecting network operations relying on the device. There is no confidentiality or integrity impact reported. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by HPE at this time, monitor the vendor's security advisories for updates. In the meantime, consider implementing network-level protections such as limiting access to the API endpoint to trusted sources to reduce exposure.