CVE-2026-73782 Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX

High 8.8 Published 1 Sep 2026 Updated 3 Sep 2026

Unauthenticated attackers can execute arbitrary code with privileged access via a format string vulnerability in the AOS-CX command line interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-73782?

CVE-2026-73782 is a high-severity code injection vulnerability in Hpe Arubaos-Cx, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Weakness: CWE-134

Which versions are affected by CVE-2026-73782?

It affects 1 product.

Products include Hpe Arubaos-Cx.

How do I fix CVE-2026-73782?

No fix has been published for CVE-2026-73782 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-73782 being exploited?

There is no known exploitation of CVE-2026-73782 in the wild and no public exploit code.

All Hpe Arubaos-Cx vulnerabilities

Sources

Also known as GHSA-7gq6-cq68-8842.