Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by hpe

CVE-2026-73757Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX

Medium 6.4

In plain English

A medium-severity server-side request forgery in AOS-CX from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

Affected products (as reported)

VendorProductVersions
Hewlett Packard Enterprise (HPE) AOS-CX 10.18.0000 – through 10.18.000110.17.0000 – through 10.17.102110.16.0000 – through 10.16.105110.13.0000 – through 10.13.118010.10.0000 – through 10.10.1180

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References