High severity · published Sep 1, 2026
CVE-2026-73763
Unauthenticated Remote Command Execution in Management Component
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
AOS-CX · Hewlett Packard Enterprise (HPE)
10.18.0000 through 10.18.0001; 10.17.0000 through 10.17.1021; 10.16.0000 through 10.16.1051; 10.13.0000 through 10.13.1180; 10.10.0000 through 10.10.1180 · source: vendor
AR
Arubaos-cx · Hpe
through 10.10.1180; 10.13.0000 through 10.13.1180; 10.16.0000 through 10.16.1051; 10.17.0000 through 10.17.1021; 10.18.0001 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73763
Patch
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US
More from AOS-CX
9.8
CVE-2026-73778
Credential Manager Vulnerability Allows Unauthorized Administrative Access
9.8
CVE-2026-73749
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
8.8
CVE-2026-73782
Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX
8.8
CVE-2026-73753
Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface
8.8
CVE-2026-73752
Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX