CVE-2026-73765CWE-22path-traversal

CVE-2026-73765

High · published September 2, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00870 · 58.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-02T01:18Z
Affected products (5)
ProductVersionsFixed in
hpe/arubaos-cx≤ 10.10.1180—
hpe/arubaos-cx≥ 10.13.0000, ≤ 10.13.1180—
hpe/arubaos-cx≥ 10.16.0000, ≤ 10.16.1051—
hpe/arubaos-cx≥ 10.17.0000, ≤ 10.17.1021—
hpe/arubaos-cxall versions—
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 01 SEP 20:28Z
    Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX
    cvelistv5