HPE AOS-CX CVE-2026-73771

Network reachability to the AOS-CX management interface or REST API is required. The CVSS AC:H metric and vendor's explicit 'under specific conditions' language indicate non-default or non-trivial exploitation prerequisites - the UI:R metric suggests exploitation may require an active administrative session to be present, a race condition window, or specific timing. The auth bypass outcome likely requires tighter conditions than the DoS path. Limiting factors: management interface not exposed to untrusted networks (standard hardening eliminates the AV:N vector entirely); AC:H and UI:R together make automated or opportunistic exploitation unlikely; the specific triggering conditions are not enumerated in available input data and must be confirmed from the HPE advisory.

CVSS 7.5 with AC:H and UI:R significantly moderates what would otherwise be a critical unauthenticated auth-bypass. The high attack complexity requirement - and the vendor's explicit 'under specific conditions' language - suggests exploitation is non-trivial and unlikely to be reliably automated. The UI:R metric is unusual for an auth bypass and may indicate a race condition against an active administrative session or a precise timing requirement, further constraining opportunistic exploitation. The dual-outcome nature of the vulnerability (auth bypass OR DoS) suggests the DoS path may be more reproducible under the required conditions, while auth bypass may demand tighter precision. No EPSS or KEV data is available for this CVE; however, the same advisory (HPESBNW05134) also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749), which elevates the overall patching urgency for the platform. Organizations that have already restricted management interface access to out-of-band or management-VRF networks face materially lower real-world risk from this specific CVE.

A remote unauthenticated attacker with network access to an HPE AOS-CX management interface sends a specially crafted authentication request, exploiting improper auth processing under specific conditions - potentially timed against an active admin session - to bypass authentication controls and gain full management plane access to the switch. Alternatively, the attacker floods the authentication endpoint with crafted requests to exhaust processing resources and render the management interface unavailable to legitimate administrators.