CVE-2026-73781: Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface
A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is the likely victim?
An authenticated remote attacker can exploit the issue, and the stored script is executed when an administrative user accesses the affected web-based management interface.
What impact can a successful exploit have?
The attacker can execute arbitrary script code in the victim administrator's browser in the context of the affected interface. The supplied severity vector indicates potential impact to confidentiality, integrity, and availability beyond the vulnerable component's security scope.
Does exploitation require user interaction or existing access?
Yes. The attacker must already be authenticated to the interface, and an administrative user must interact with content that causes the stored script to run.