{"id":"CVE-2026-73755","title":"Privilege Escalation via Unauthorized Access to Sensitive Session Information","summary":"A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerabl…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvssSource":"cna","vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-CX","affected":["AOS-CX >= 10.18.0000 <= 10.18.0001","AOS-CX >= 10.17.0000 <= 10.17.1021","AOS-CX >= 10.16.0000 <= 10.16.1051","AOS-CX >= 10.13.0000 <= 10.13.1180","AOS-CX >= 10.10.0000 <= 10.10.1180"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-03T03:56:17.464604Z"},"published":"2026-09-01","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:13:32.192Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73755","references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US"}],"tags":["cve.org"],"epss":0.00306,"epssPercentile":0.23564,"ingestedAt":"2026-11-05T20:33:06.581Z","slug":"CVE-2026-73755","body":"## Overview\n\nA privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system.\n\n## Affected\n\n- `AOS-CX >= 10.18.0000 <= 10.18.0001`\n- `AOS-CX >= 10.17.0000 <= 10.17.1021`\n- `AOS-CX >= 10.16.0000 <= 10.16.1051`\n- `AOS-CX >= 10.13.0000 <= 10.13.1180`\n- `AOS-CX >= 10.10.0000 <= 10.10.1180`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}