HPE AOS-CX CVE-2026-73764

The attacker must be on the same network segment (Layer-2 adjacent) as the AOS-CX switch management interface - this is the primary limiting condition enforced by the AV:A CVSS metric. No authentication is required (PR:N), and no user interaction is needed (UI:N). The management interface must be reachable from the attacker's position, which is typical in environments where the management VLAN is co-hosted with user or server VLANs rather than isolated. Exploitation does not appear to require a specific non-default configuration based on available data; however, the exact protocol or interface (REST API, SSH, OVSDB) through which the bypass is triggered is not specified in the advisory. Confidentiality impact is explicitly absent (C:N per CVSS), meaning sensitive data exfiltration is not a direct consequence - exploitation is limited to unauthorized resource modification and limited availability disruption.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) yields a score of 7.1, which reflects accurately constrained real-world exploitability: the adjacent-network requirement means an attacker must already be on the same Layer-2 segment or VLAN as the switch management interface, significantly reducing the exposed population relative to a fully internet-facing service. The integrity impact is rated High, meaning successful exploitation could result in unauthorized reconfiguration of the switch - a serious outcome in any network infrastructure context - while availability impact is rated Low, consistent with the advisory language of 'limited disruption.' No EPSS data was provided in the input, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed active exploitation. That said, even a mid-sized municipal IT team in koszalin should treat this as urgent if HPE AOS-CX switches are deployed with management interfaces accessible from shared VLANs or inadequately segmented networks, since an adjacent attacker on such a segment faces low complexity exploitation with no privilege requirement. The absence of a CWE assignment and no specific affected version range in the advisory are gaps that slightly reduce confidence in scoping the exposure.

An attacker connected to the same management VLAN or Layer-2 segment as an AOS-CX switch sends crafted network requests that bypass the device's authentication logic without supplying valid credentials. Once authentication is circumvented, the attacker issues configuration commands - such as altering routing tables, ACLs, or port configurations - resulting in unauthorized network changes and potential traffic disruption. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the bypass does not require sophisticated tooling once the exploitation method is known.