HPE AOS-CX CVE-2026-73781

The attacker must be authenticated to the AOS-CX web management interface with high privileges (PR:H per CVSS vector) - exploitation is not possible without prior administrative credential access. A second condition is that a victim administrator must actively view (UI:R) the page where the payload is stored. Exploitation is limited to environments where the AOS-CX web management interface is accessible over the network; deployments that restrict management-plane access to a dedicated OOB network or disable the web interface entirely are not reachable. No non-default configuration of AOS-CX is required beyond having the web interface enabled, which is typical for managed switch deployments.

The CVSS score of 8.4 is driven primarily by the scope change (S:C) and full-triad impact (C:H/I:H/A:H), not by attacker privilege level - PR:H correctly signals that an attacker must already hold high-privilege credentials on the management interface. Real-world risk is therefore gated by that initial access requirement; an unauthenticated external threat actor cannot exploit this directly. However, in enterprise switch deployments where multiple administrators share access to the AOS-CX interface, a compromised or malicious insider, a phishing-obtained admin credential, or lateral movement from another breached system creates a plausible path to inject the payload. The session-hijacking impact is significant because AOS-CX controls network switching infrastructure, so a hijacked admin session could enable configuration changes with broad network-level consequences. No EPSS data or KEV listing is present in the input; EPSS is likely low given the PR:H prerequisite, which significantly limits the attack surface relative to the CVSS score. No public exploit has been identified at time of analysis.

An attacker who has obtained AOS-CX administrator credentials - via credential stuffing, phishing, or lateral movement - logs into the web management interface and injects a malicious JavaScript payload into a stored configuration field such as a hostname, description, or log entry. When a second administrator later views the affected page in their browser, the stored script executes silently, exfiltrates the victim's session cookie to an attacker-controlled server, and grants the attacker a second authenticated session with full administrative control over the switch. No public exploit code has been identified at time of analysis, but standard browser developer tools are sufficient to craft the payload.