CVE-2026-73765

HighCVSS 7.2/10Last modified Sep 4, 2026

Description

Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	AOS-CX	>= 10.18.0000, <= 10.18.0001; >= 10.17.0000, <= 10.17.1021; >= 10.16.0000, <= 10.16.1051; >= 10.13.0000, <= 10.13.1180; >= 10.10.0000, <= 10.10.1180

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_USPatch, Vendor Advisory

Timeline

Published: Sep 1, 2026
Last modified: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-737667.2Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges CVE-2026-737677.2Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilit CVE-2026-737687.3A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploit CVE-2026-737697.2A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve rem CVE-2026-73775.4GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 t CVE-2026-737707.3An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, CVE-2026-737717.5An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unau CVE-2026-737726.5Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition b CVE-2026-737737.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability CVE-2026-737747.6A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensiti CVE-2026-737757.7Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive informatio CVE-2026-737767.9A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authent