CVE-2026-73752

HighCVSS 8.8/10Last modified Sep 22, 2026

Description

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	AOS-CX	>= 10.18.0000, <= 10.18.0001; >= 10.17.0000, <= 10.17.1021; >= 10.16.0000, <= 10.16.1051; >= 10.13.0000, <= 10.13.1180; >= 10.10.0000, <= 10.10.1180

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_USVendor Advisory

Timeline

Published: Sep 1, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-737538.8Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a pr CVE-2026-737545.3Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user t CVE-2026-737555.7A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privileg CVE-2026-737565.9A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-CVE-2026-737576.4A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side reques CVE-2026-737586.5A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privileg CVE-2026-737596.5Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending speciall CVE-2026-73767.5Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-737606.5An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arb CVE-2026-737616.5An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information discl CVE-2026-737626.6A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In CVE-2026-737638.8A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Succes