CVE-2026-73762
Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
- Record
CVE-2026-73762- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-69626
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
- Record
EUVD-2026-69626- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4ggp-mpch-2mfq
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor...
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
- Record
GHSA-4ggp-mpch-2mfq- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
- Record
CVE-2026-73762- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-73762 is a medium vulnerability (CVSS 6.6) in Hewlett Packard Enterprise (hpe) Aos-cx, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.