CVE-2026-73751High· 8.8▾ TwilightAn authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system.
arubaos-cx <= 10.10.1180arubaos-cx >= 10.13.0000, <= 10.13.1180arubaos-cx >= 10.16.0000, <= 10.16.1051arubaos-cx >= 10.17.0000, <= 10.17.1021arubaos-cx = 10.18.0001Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73763High· 7.1A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands
CVE-2026-73750High· 8.8Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input
CVE-2026-73778High· 8.1A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access
CVE-2026-73753High· 8.8Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2026-23815High· 7.2A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection
CVE-2026-23814High· 8.8A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.