CVE-2026-73757: A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF)…

PriorityP338medium6.4CVSS 3.1

AVNACLPRLUINSCCLILAN

EPSS

0.29%

21.5th percentile

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	aos-cx	10.10.0000 – 10.10.1180	—
hewlett_packard_enterprise	aos-cx	10.13.0000 – 10.13.1180	—
hewlett_packard_enterprise	aos-cx	10.16.0000 – 10.16.1051	—
hewlett_packard_enterprise	aos-cx	10.17.0000 – 10.17.1021	—
hewlett_packard_enterprise	aos-cx	10.18.0000 – 10.18.0001	—
hpe	arubaos-cx	<= 10.10.1180	—
hpe	arubaos-cx	—	—
hpe	arubaos-cx	10.13.0000 – 10.13.1180	—
hpe	arubaos-cx	10.16.0000 – 10.16.1051	—
hpe	arubaos-cx	10.17.0000 – 10.17.1021	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.