CVE-2026-73763CWE-77command-injection

CVE-2026-73763

High · published September 2, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-09-02T01:18Z
Affected products (5)
ProductVersionsFixed in
hpe/arubaos-cx≤ 10.10.1180—
hpe/arubaos-cx≥ 10.13.0000, ≤ 10.13.1180—
hpe/arubaos-cx≥ 10.16.0000, ≤ 10.16.1051—
hpe/arubaos-cx≥ 10.17.0000, ≤ 10.17.1021—
hpe/arubaos-cxall versions—
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 20:28Z
    Unauthenticated Remote Command Execution in Management Component
    cvelistv5