HPE AOS-CX CVE-2026-73773

No authentication is required - the CVSS vector is PR:N/UI:N/AV:N, confirming unauthenticated remote exploitability against the AOS-CX management API endpoint. The primary prerequisite is network-layer reachability to the API service (typically TCP 443 on the management interface). Organizations that restrict management API access to a dedicated out-of-band management network or that enforce ACL-based allow-lists on management interfaces are substantially protected. The specific API endpoint, triggering payload, or service name is not disclosed in the available data.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately describes a low-complexity, network-reachable, zero-authentication DoS - a realistic and impactful threat for network infrastructure where switch availability is operationally critical. No EPSS score is provided, the CVE has no CISA KEV listing, and no public PoC has been identified, placing this at a lower immediate urgency than the unauthenticated RCE (CVE-2026-73749) in the same advisory. However, the combination of PR:N and AV:N means any host with network path to the AOS-CX management API can trigger the condition - organizations exposing the management interface to untrusted segments face elevated risk. The impact is scoped (S:U), so the DoS is limited to the affected service rather than cascading to adjacent systems, but disruption of a core switch's API or control-plane service can indirectly affect downstream traffic.

An attacker with network access to the AOS-CX management API sends a specially crafted unauthenticated HTTP request to the vulnerable endpoint, causing the targeted service to crash or exhaust resources and become unavailable. No credentials are required, so the attack is trivially repeatable from any reachable host. Sustained exploitation could keep the service in a degraded state, disrupting switch management and potentially affecting control-plane operations depending on which API service is affected.