EUVD-2026-69639
GHSA-cpw3-5jq9-5gf5
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Pre-conditions outside attacker control warrant AC:H over the reported AC:L; admin CLI access is PR:H; OS escape confirms S:C; no availability impact stated.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of the attacker’s control are met.
AnalysisAI
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated AOS-CX CLI session with administrative (high) privileges - PR:H in the CVSS vector confirms this requirement; (2) local access to the CLI, meaning physical console or an established SSH management session (AV:L - not directly network-reachable); and (3) 'certain pre-conditions outside of the attacker's control,' an unspecified system state or configuration that must be present for the signature bypass to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | At CVSS 7.9 (High), this vulnerability carries a meaningful score but is substantially constrained in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US for available patches and specific fixed firmware versions; no exact fix version is identifiable from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all HPE AOS-CX deployments and review administrator CLI usage logs for any suspicious activity; note that the advisory has not specified which AOS-CX versions are affected, so consult HPE documentation to determine scope within your organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Share
External POC / Exploit Code
Leaving vuln.today