CVE-2026-73777: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

CVE-2026-73777 identifies a security weakness in the API endpoint of HPE AOS-CX switches that could enable an unauthenticated remote attacker to circumvent authentication mechanisms. The vulnerability corresponds to CWE-287 (Improper Authentication). It affects specific versions of AOS-CX, including 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated remote attacker to bypass authentication controls on the affected AOS-CX API endpoint, potentially leading to full compromise of confidentiality, integrity, and availability of the device. This could result in unauthorized access and control over network switch functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected API endpoints to trusted management networks and monitor for unusual access attempts. Follow HPE's official communications for updates on patches or mitigations.