CVE-2026-73778
Critical
9.8 CVSS v3.1
- Published
- Sep 1, 2026
- Updated
- Sep 10, 2026
- Vendor
- Hpe
- Affected versions
- See affected products
- Weakness
- CWE-521
Summary
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.
Severity
Critical (9.8)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
- Hpe Arubaos-cx = 10.13.0000, = 10.16.0000, = 10.17.0000, <= 10.17.1021
- Hpe Arubaos-cx 10.18.0001
Exploitation status
Unknown
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
Follow the vendor advisory linked below for patches and workarounds.