CVE-2026-73780: Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

High severity · published Sep 1, 2026

CVE-2026-73780

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

8.3

CVSS

0.2%

EPSS

On KEV

Description

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 10% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AOS-CX · Hewlett Packard Enterprise (HPE)

10.18.0000 through 10.18.0001; 10.17.0000 through 10.17.1021; 10.16.0000 through 10.16.1051; 10.13.0000 through 10.13.1180; 10.10.0000 through 10.10.1180 · source: vendor

Arubaos-cx · Hpe

before 10.10.1181; 10.13.0000 before 10.13.1190; 10.16.0000 before 10.16.1060; 10.17.0000 before 10.17.1030; 10.18.0001 · source: NVD

Affected product

AOS-CX

Hewlett Packard Enterprise (HPE)

All AOS-CX CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-73780

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-73780

Vendor Advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US