CVE-2026-73766: Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX
Published Sep 1, 2026
·Updated
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Affected Software
1 affected component
AOS-CX AOS-CX
Event History
Sep 1, 2026
CVE Published
via MITRE·08:28 PM
Data Sourced
via MITRE·08:28 PM
DescriptionSeverity
Frequently Asked Questions
1
Who is exposed to exploitation?
AOS-CX deployments whose API endpoint is reachable by a remote authenticated user with administrative privileges are exposed. The issue requires high privileges and does not require user interaction.
2
What does an attacker need to exploit this issue?
The attacker needs remote access to the API endpoint and valid administrative authentication. Exploitation is described as low complexity and can result in arbitrary commands being run as a privileged operating-system user.