{"api_version":"1","generated_at":"2026-09-03T03:55:44+00:00","cve":"CVE-2026-73774","urls":{"html":"https://cve.report/CVE-2026-73774","api":"https://cve.report/api/cve/CVE-2026-73774.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-73774","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-73774"},"summary":{"title":"Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX","description":"A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure or modification of information and disruption of the affected system.","state":"PUBLISHED","assigner":"hpe","published_at":"2026-09-01 21:18:44","updated_at":"2026-09-02 19:34:36"},"problem_types":["CWE-120","CWE-120 CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"],"metrics":[{"version":"3.1","source":"security-alert@hpe.com","type":"Secondary","score":"7.6","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.6","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US","name":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US","refsource":"security-alert@hpe.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73774","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73774","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","version":"affected 10.18.0000 10.18.0001 semver","platforms":[]},{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","version":"affected 10.17.0000 10.17.1021 semver","platforms":[]},{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","version":"affected 10.16.0000 10.16.1051 semver","platforms":[]},{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","version":"affected 10.13.0000 10.13.1180 semver","platforms":[]},{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","version":"affected 10.10.0000 10.10.1180 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"This vulnerability was discovered by internal security research at HPE Networking.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"73774","cve":"CVE-2026-73774","epss":"0.001910000","percentile":"0.087560000","score_date":"2026-09-02","updated_at":"2026-09-03 00:14:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-73774","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-02T12:44:08.078407Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-02T12:44:11.319Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"affected","product":"AOS-CX","vendor":"Hewlett Packard Enterprise (HPE)","versions":[{"lessThanOrEqual":"10.18.0001","status":"affected","version":"10.18.0000","versionType":"semver"},{"lessThanOrEqual":"10.17.1021","status":"affected","version":"10.17.0000","versionType":"semver"},{"lessThanOrEqual":"10.16.1051","status":"affected","version":"10.16.0000","versionType":"semver"},{"lessThanOrEqual":"10.13.1180","status":"affected","version":"10.13.0000","versionType":"semver"},{"lessThanOrEqual":"10.10.1180","status":"affected","version":"10.10.0000","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"This vulnerability was discovered by internal security research at HPE Networking."}],"descriptions":[{"lang":"en","value":"A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure or modification of information and disruption of the affected system."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"dateUpdated":"2026-09-01T20:28:42.765Z","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe"},"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US"}],"source":{"advisory":"HPESBNW05134","discovery":"INTERNAL"},"title":"Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","assignerShortName":"hpe","cveId":"CVE-2026-73774","datePublished":"2026-09-01T20:28:42.765Z","dateReserved":"2026-08-13T16:39:09.490Z","dateUpdated":"2026-09-02T12:44:11.319Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-01 21:18:44","lastModifiedDate":"2026-09-02 19:34:36","problem_types":["CWE-120","CWE-120 CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-02T12:44:08.078407Z","id":"CVE-2026-73774","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"73774","Ordinal":"1","Title":"Unauthenticated Buffer Overflow Vulnerability leads to Sensitive","CVE":"CVE-2026-73774","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"73774","Ordinal":"1","NoteData":"A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure or modification of information and disruption of the affected system.","Type":"Description","Title":"Unauthenticated Buffer Overflow Vulnerability leads to Sensitive"}]}}}