HPE AOS-CX CVE-2026-73751

Exploitation requires two concrete prerequisites: (1) a valid account on the AOS-CX web-based management interface with at minimum low-privileged access, and (2) network-level reachability to that interface. The CVSS PR:L confirms no administrator or elevated privilege is needed. Limiting factors: the attacker cannot exploit this without some form of valid credential - there is no unauthenticated path (PR:N does not apply here). Environments that isolate the management interface to a dedicated out-of-band VLAN with strict source-IP ACLs, or that enforce multi-factor authentication on management plane access, substantially reduce real-world risk even before patching. Non-default configurations that disable the web management interface entirely are not vulnerable.

The CVSS 8.8 score is well-calibrated for this class of vulnerability. PR:L is the primary limiting factor - the attacker must hold a valid account on the management interface - but in enterprise environments with shared network-team credentials, service accounts, or after any credential theft event, this bar is realistically cleared. AC:L confirms no special timing, race conditions, or non-default configuration is required beyond having that account. The S:U (unchanged scope) is consistent with the attack remaining within the AOS-CX OS boundary. No EPSS score, KEV listing, or POC is available from the provided data, so exploitation urgency cannot be confirmed externally; risk is assessed from CVSS signals alone. The combination of network reachability, low privilege requirement, and full system impact (C:H/I:H/A:H) places this firmly in the genuine-priority tier for any organization with AOS-CX switches exposed on a management network reachable beyond a strict allowlist.

An attacker who has obtained low-privileged AOS-CX management interface credentials - via phishing, credential reuse from another compromised system, or insider access - submits a crafted payload to a vulnerable input field in the web UI. The unsanitized input is passed to an OS command execution routine, and injected shell commands run with the privileges of the web server process on the switch. No public exploit code has been identified at time of analysis, but the low attack complexity implies exploitation is straightforward once valid credentials are in hand.