Unauthorized Access Risk in Credential Manager of HPE Devices
CVE-2026-73778

8.1HIGH

Key Information:

Vendor

HP (HP)

Status
Aos-cx
Vendor
CVE Published:
1 September 2026

What is CVE-2026-73778?

A security vulnerability in the Credential Manager component of HPE devices allows for unauthorized administrative access. This issue can be exploited by an unauthenticated remote attacker on devices that remain in their factory-default or post-Zero Touch Provisioning (ZTP) state. Attackers can gain unauthorized access by using a predictable factory-default password before any configuration is made by an administrator. If exploited successfully, this could give intruders full administrative control during the initial setup process, posing significant risks to device integrity and security.

Affected Version(s)

AOS-CX 10.18.0000 <= 10.18.0001

AOS-CX 10.18.0000 <= 10.18.0001

AOS-CX 10.17.0000 <= 10.17.1021

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was discovered by internal security research at HPE Networking.
.