CVE-2026-73780: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX switches' web management interface allows remote attackers to exploit the absence of CSRF protection. An attacker could trick an authenticated user into interacting with a malicious URL, leading to arbitrary input execution on the interface. The CVSS v3.1 score is 8.3, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity. The affected versions are specific releases of AOS-CX software including 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000.

Successful exploitation could allow an attacker to execute arbitrary commands on the management interface, potentially leading to full compromise of the device's confidentiality, integrity, and availability. The attack requires user interaction but no privileges or prior authentication by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with URLs related to the management interface and restrict access to the web management interface to trusted networks and users only.