Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX
Summary
| CVE | CVE-2026-73764 |
|---|---|
| State | PUBLISHED |
| Assigner | hpe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-01 21:18:43 UTC |
| Updated | 2026-09-04 15:00:18 UTC |
| Description | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of affected services. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS: 0.002130000 probability, percentile 0.115190000 (date 2026-09-07)
Problem Types: CWE-287 | CWE-287 CWE-287 Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
| 3.1 | CNA | CVSS | 7.1 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
LowCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Hewlett Packard Enterprise HPE | AOS-CX | affected 10.18.0000 10.18.0001 semver | Not specified |
| CNA | Hewlett Packard Enterprise HPE | AOS-CX | affected 10.17.0000 10.17.1021 semver | Not specified |
| CNA | Hewlett Packard Enterprise HPE | AOS-CX | affected 10.16.0000 10.16.1051 semver | Not specified |
| CNA | Hewlett Packard Enterprise HPE | AOS-CX | affected 10.13.0000 10.13.1180 semver | Not specified |
| CNA | Hewlett Packard Enterprise HPE | AOS-CX | affected 10.10.0000 10.10.1180 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.hpe.com/hpesc/public/docDisplay | [email protected] | support.hpe.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This vulnerability was discovered by internal security research at HPE Networking. (en)
There are currently no legacy QID mappings associated with this CVE.