CVE-2026-73778: A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could…

PriorityP270critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.28%

20.8th percentile

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	aos-cx	10.10.0000 – 10.10.1180	—
hewlett_packard_enterprise	aos-cx	10.13.0000 – 10.13.1180	—
hewlett_packard_enterprise	aos-cx	10.16.0000 – 10.16.1051	—
hewlett_packard_enterprise	aos-cx	10.17.0000 – 10.17.1021	—
hewlett_packard_enterprise	aos-cx	10.18.0000 – 10.18.0001	—
hpe	arubaos-cx	<= 10.10.1180	—
hpe	arubaos-cx	—	—
hpe	arubaos-cx	10.13.0000 – 10.13.1180	—
hpe	arubaos-cx	10.16.0000 – 10.16.1051	—
hpe	arubaos-cx	10.17.0000 – 10.17.1021	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.