CVE-2026-73775: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability in HPE AOS-CX API endpoint permits remote attackers authenticated with low privileges to retrieve sensitive information. The flaw is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. Affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000. No patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

An attacker with low-privilege authentication can access sensitive information through the vulnerable API endpoint. This exposure could be leveraged to gain further access to network services managed by AOS-CX, potentially compromising network security. There is no direct impact on data integrity or system availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor HPE advisories for updates. Until a patch is available, restrict access to the API endpoint to trusted users and networks where possible to reduce risk.