CVE-2026-73756

published 2026-09-01

CVE-2026-73756: A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack…

Priority P3 36 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C H I N A N

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitation allows an attacker to retrieve data which could be used to further compromise the confidentiality of the affected system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	aos-cx	10.10.0000 – 10.10.1180	—
hewlett_packard_enterprise	aos-cx	10.13.0000 – 10.13.1180	—
hewlett_packard_enterprise	aos-cx	10.16.0000 – 10.16.1051	—
hewlett_packard_enterprise	aos-cx	10.17.0000 – 10.17.1021	—
hewlett_packard_enterprise	aos-cx	10.18.0000 – 10.18.0001	—
hpe	arubaos-cx	<= 10.10.1180	—
hpe	arubaos-cx	—	—
hpe	arubaos-cx	10.13.0000 – 10.13.1180	—
hpe	arubaos-cx	10.16.0000 – 10.16.1051	—
hpe	arubaos-cx	10.17.0000 – 10.17.1021	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-319