CVE-2026-73750 Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

High 8.8 Published 1 Sep 2026 Updated 3 Sep 2026

Authenticated attackers can trigger buffer overflows in the AOS-CX API to achieve remote code execution or denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-73750?

CVE-2026-73750 is a high-severity memory corruption vulnerability in Hpe Arubaos-Cx, published on 1 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.

Weakness: CWE-284

Which versions are affected by CVE-2026-73750?

It affects 1 product.

Products include Hpe Arubaos-Cx.

How do I fix CVE-2026-73750?

No fix has been published for CVE-2026-73750 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-73750 being exploited?

There is no known exploitation of CVE-2026-73750 in the wild and no public exploit code.

All Hpe Arubaos-Cx vulnerabilities

Sources

Also known as GHSA-646j-3mmf-7h29.