CVE-2026-73762: Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access
Published Sep 1, 2026
·Updated
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.
Affected Software
1 affected component
AOS-CX
Event History
Sep 1, 2026
CVE Published
via MITRE·08:28 PM
Data Sourced
via MITRE·08:28 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need before exploiting this issue?
The vector indicates that the attacker must already have high privileges (PR:H). Exploitation is remote, requires no user interaction, and is assessed as low complexity.
2
What impact could successful exploitation have?
Successful exploitation could bypass configured access-control policy and expose management functionality that should be restricted. The reported impact includes low confidentiality, integrity, and availability effects, with scope changed.