HPE AOS-CX CVE-2026-73763

Adjacent network access to the AOS-CX management interface is the sole prerequisite; no authentication is required (PR:N per CVSS). 'Adjacent' means the attacker must be on the same broadcast domain, VLAN, or directly connected network segment as the management interface - internet-based remote attackers are excluded. The exact management protocol or API endpoint involved is not specified in available data. Exploitation is limited to network segments with direct reachability to the management plane; environments that isolate management interfaces on dedicated out-of-band VLANs with strict ACLs face substantially reduced exposure. All AOS-CX versions within the five affected release branches are vulnerable regardless of specific feature configuration.

CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: no authentication, no user interaction, and full confidentiality, integrity, and availability impact on the device. The AV:A constraint is the primary risk-limiting factor - exploitation requires presence on the same network segment as the management interface, which in well-segmented environments means only internal trusted personnel or an attacker who has already established an adjacent foothold. EPSS at 0.26% (18th percentile) and SSVC Exploitation=none converge: this is not under active mass exploitation. SSVC Automatable=no despite AC:L and PR:N is noteworthy - this suggests that while individual exploitation is straightforward, reliable automated scanning or worm-like propagation faces a practical barrier, possibly due to protocol specifics or interface enumeration requirements. SSVC Technical Impact=total confirms that a successful exploit yields full device compromise. This CVE shares the same HPE advisory (hpesbnw05134) as at least four other AOS-CX CVEs (73749, 73766, 73778, 73782), indicating a broad security review of the platform; defenders should treat the entire advisory as a single remediation event.

An attacker with access to the management VLAN - for example, a malicious insider, a compromised device on the same broadcast domain, or an attacker who has pivoted through an existing network foothold - sends a crafted request to the AOS-CX management component containing injected command metacharacters. Because the component does not sanitize input before passing it to an OS command interpreter, the injected payload executes with the privileges of the management utility, granting the attacker full control over the switch, including the ability to read credentials, alter routing/ACL configurations, or render the device unavailable. No credentials or user interaction are required, and no public exploit code has been identified at time of analysis.