← Vulnerability feed

Vulnerability record · CVE-2026-73771 · published 1 September 2026

CVE-2026-73771: Hpe arubaos-cx improper authentication vulnerability

Hpe · Arubaos Cx

An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote attacker could exploit this vulnerability under specific conditions to bypass authentication controls or exhaust system resources. Successful exploitation could result in unauthorized access or denial of service affecting the management interface.

7.5 CVSS 3.1 High EPSS 0.47% · top 61.7% CWE-287 · Improper authentication
7.5CVSS 3.1 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
4 Sep 2026Last modified by NVD

Description

An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote attacker could exploit this vulnerability under specific conditions to bypass authentication controls or exhaust system resources. Successful exploitation could result in unauthorized access or denial of service affecting the management interface.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US PatchVendor Advisory

Track CVE-2026-73771 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-73778Hpe arubaos-cx weak password requirements vulnerabilityA vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker …EPSS 0.51%9.8CVE-2026-73749Hpe arubaos-cx improper access control vulnerabilityMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker co…EPSS 0.82%9.8CVE-2026-23813Hpe arubaos-cx improper authentication vulnerabilityA vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote a…EPSS 0.74%8.8CVE-2026-73782Hpe arubaos-cx vulnerabilityA format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exp…EPSS 0.42%8.8CVE-2026-73763Hpe arubaos-cx command injection vulnerabilityA vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful expl…EPSS 0.48%8.8CVE-2026-73750Hpe arubaos-cx improper access control vulnerabilityVulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could e…EPSS 0.80%8.8CVE-2026-73751Hpe arubaos-cx command injection vulnerabilityAn authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands …EPSS 0.66%8.8CVE-2026-73752Hpe arubaos-cx path traversal vulnerabilityAn unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an at…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2026-73771), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.