CVE-2026-73776: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability (CVE-2026-73776) in HPE AOS-CX allows an authenticated malicious actor with administrative privileges to bypass signature verification in the command line interface. Successful exploitation could lead to arbitrary code execution on the underlying OS, contingent on certain pre-conditions outside the attacker's control. The CVSS 3.1 base score is 7.9, indicating high severity, with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with scope changed. The affected versions explicitly include =10.10.0000, =10.13.0000, =10.16.0000, =10.17.0000, and =10.18.0000. No vendor advisory or patch information is available to confirm remediation status.

An attacker with administrative privileges on affected versions of HPE AOS-CX could bypass signature verification in the CLI and execute arbitrary code on the underlying operating system. This compromises confidentiality and integrity of the system. Availability impact is not indicated. The attack requires local access and high privileges, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to CLI usage. Avoid relying solely on signature verification for critical operations in affected versions.