HPE AOS-CX CVE-2026-73775

Exploitation requires a valid AOS-CX account with at minimum low-privilege access (PR:L per CVSS vector); unauthenticated exploitation is not indicated. Network-level access to the AOS-CX API endpoint is required (AV:N, AC:L - no special network position or complexity beyond reachability). No non-default configuration or specific feature enablement is described as a prerequisite. What limits exploitation: the attacker must first possess valid credentials of any privilege level, which is a meaningful barrier in environments with strict account controls and no self-registration. The scope change means the meaningful risk materializes when the disclosed data is used to attack downstream network services, not from the initial disclosure alone.

The CVSS 7.7 score is driven primarily by the scope change (S:C) and high confidentiality impact (C:H) rather than ease of access - PR:L represents a meaningful barrier requiring valid credentials. In practice, this shifts the threat model toward insider threat, compromised low-privilege accounts, or environments that permit self-registration or guest accounts. No EPSS data, KEV listing, or POC has been identified, which collectively suggests opportunistic mass exploitation is not currently occurring. The S:C metric is the most significant signal: if the disclosed information includes credentials, API keys, or routing/topology details for adjacent network services, the downstream blast radius exceeds what the 7.7 score alone implies. The absence of a CWE classification limits confidence in root-cause specificity.

An attacker who has obtained a low-privilege AOS-CX account - through credential stuffing, phishing, or a shared service account - sends crafted requests to the vulnerable API endpoint over the network. The API returns sensitive information such as configuration data, neighbor credentials, or service keys that the low-privilege role should not access. The attacker then uses this disclosed information to authenticate to or enumerate adjacent network services managed by AOS-CX, achieving lateral movement.