CVE-2026-73777 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Network administrators and security teams responsible for AOS-CX switches should assess exposure and prioritize patching. Additionally, operators managing network infrastructure, platform owners of AOS-CX deployments, vulnerability management teams, and security teams overseeing network device security should also evaluate their exposure and take necessary actions to mitigate potential risks.

Why it matters

CVE-2026-73777 is a HIGH-severity vulnerability in AOS-CX switches that could allow an unauthenticated remote actor to bypass existing authentication controls, potentially leading to unauthorized access and control of network devices.

• Verify authentication controls for API endpoints
• Check for affected AOS-CX versions in inventory
• Monitor API endpoint activity for suspicious requests
• Restrict access to API endpoints if patches cannot be applied immediately

Technical summary

The vulnerability (CVE-2026-73777) is in the API endpoint of AOS-CX switches, allowing an unauthenticated remote actor to bypass existing authentication controls. This has a CVSS score of 8.1, indicating a HIGH severity. Affected versions include 10.10.1180, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0001. The official CVE Program record and NIST NVD detail page provide further information.

Defensive priority

Defenders should prioritize verifying and applying patches from HPE, checking inventory for affected AOS-CX versions, and monitoring API endpoint activity.

Recommended defensive actions

• Verify and apply patches from HPE
• Check inventory for affected AOS-CX versions
• Monitor API endpoint activity
• Restrict access to API endpoints

Evidence notes

The CVE description notes vulnerabilities in the API endpoint of AOS-CX switches that could allow an unauthenticated remote actor to bypass existing authentication controls. The CVSS score is 8.1, indicating a HIGH severity. The official CVE Program record and NIST NVD detail page provide further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.