HPE AOS-CX CVE-2026-73767

Exploitation requires authentication with a high-privilege account (PR:H per CVSS) - specifically, an admin-level CLI user on the AOS-CX management interface. The management interface must be reachable over the network (AV:N); in environments where the management plane is restricted to an out-of-band network or a tightly ACL-controlled VLAN, network-path access is itself a prerequisite. No special non-default configuration beyond having admin CLI access is required once credentials are obtained. Limiting factors: the requirement for high-privilege credentials substantially narrows the realistic attacker population to insiders, credential-compromised operators, or attackers who have already achieved significant lateral movement; unauthenticated or low-privilege users cannot exploit this vulnerability.

The CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the dual nature of this vulnerability: severe impact upon success, but gated by the requirement for high-privilege authentication. An attacker must already possess admin-level credentials to reach the injection point, significantly reducing the autonomous exploitation surface compared to a PR:N flaw. The management plane is typically reachable over the network (AV:N), but in well-segmented environments the management interface is restricted to a dedicated VLAN or out-of-band network, further limiting exposure. EPSS data is absent from available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public POC has been identified. The primary real-world risk scenario is insider threat, credential compromise, or lateral movement by an attacker who has already obtained switch admin credentials - this vulnerability then enables OS-level persistence or deeper network infrastructure compromise beyond what the CLI alone would permit.

An attacker who has obtained administrative credentials for an AOS-CX switch - through credential theft, phishing, or lateral movement - connects to the management interface over SSH and submits a crafted CLI command containing injected shell metacharacters. The CLI fails to sanitize the input, causing the underlying OS to execute arbitrary commands as a privileged user, enabling the attacker to install backdoors, exfiltrate configuration data including SNMP credentials or routing secrets, or pivot deeper into the network infrastructure. No public POC is known at time of analysis.