CVE-2026-73753: Command-Line RCE Vulnerability

CVE-2026-73753 Overview

CVE-2026-73753 is an OS command injection vulnerability [CWE-78] affecting Hewlett Packard Enterprise (HPE) products. The flaw allows an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system through affected command-line operations. HPE published a security advisory documenting the issue and the affected components.

The vulnerability carries a CVSS 3.1 base score of 8.8. Successful exploitation compromises confidentiality, integrity, and availability of the host system. The attack requires network access and low privileges, with no user interaction.

Critical Impact
Authenticated attackers with minimal privileges can escalate to a privileged operating system context and run arbitrary commands on affected HPE systems.

Affected Products

Hewlett Packard Enterprise (HPE) products referenced in advisory hpesbnw05134en_us
Specific product versions listed in the HPE Security Advisory

Discovery Timeline

2026-09-01 - CVE-2026-73753 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73753

Vulnerability Analysis

CVE-2026-73753 is classified under [CWE-78], Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The vulnerability resides in command-line interface (CLI) operations exposed by the affected HPE product. Input supplied to these CLI operations reaches an underlying operating system shell without sufficient sanitization or parameterization.

A low-privileged, authenticated user can inject shell metacharacters or command separators into parameters processed by the CLI. The injected payload executes in the security context of a privileged account, bypassing the privilege boundary enforced by the application layer. The result is full command execution against the host operating system.

The EPSS score at publication is 0.368%, indicating no current evidence of widespread exploitation attempts. However, the low privilege requirement and network attack vector make this vulnerability attractive for post-authentication lateral movement.

Root Cause

The root cause is the construction of operating system commands using untrusted input from an authenticated user without proper input validation, output encoding, or use of safe command execution APIs. The affected CLI handler concatenates user-supplied strings into a shell command line, allowing metacharacters such as ;, |, &, $(), or backticks to break the intended command structure.

Attack Vector

An attacker first authenticates to the affected HPE product using any valid low-privileged account. The attacker then invokes an affected CLI operation and supplies a crafted parameter containing shell command injection payloads. The application executes the constructed command as a privileged system user, granting the attacker code execution on the underlying host.

Technical exploitation details are described in the HPE Security Advisory. No public proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-73753

Indicators of Compromise

Unexpected child processes spawned by the HPE product service account, particularly shells such as /bin/sh, /bin/bash, or cmd.exe
CLI audit log entries containing shell metacharacters (;, |, &&, $(), backticks) in parameter values
Privileged process activity originating from low-privileged user sessions
New or modified files in system directories following CLI command execution

Detection Strategies

Monitor process ancestry to identify shell interpreters or system utilities spawned by the affected HPE service account
Inspect CLI command audit logs for parameter values containing OS command injection patterns
Correlate authenticated user sessions with subsequent privileged process creation events
Baseline normal CLI usage patterns and alert on outliers in command frequency, arguments, or execution context

Monitoring Recommendations

Forward HPE product audit logs and host process telemetry to a centralized SIEM for correlation
Enable command-line argument logging on hosts running the affected product
Review authentication logs for compromised or brute-forced low-privileged accounts
Alert on privilege transitions where a low-privileged authenticated user triggers privileged command execution

How to Mitigate CVE-2026-73753

Immediate Actions Required

Apply the vendor patch referenced in the HPE Security Advisory as soon as it is available for your deployment
Restrict network access to the CLI management interface to trusted administrative networks only
Audit all low-privileged accounts on affected systems and remove unused or stale credentials
Rotate credentials for any account with access to the affected CLI operations

Patch Information

HPE has published security advisory hpesbnw05134en_us documenting the affected products and remediation. Consult the HPE Security Advisory for specific fixed versions and upgrade procedures corresponding to your product model.

Workarounds

Limit CLI access to a minimal set of trusted administrative accounts pending patch deployment
Enforce network segmentation and access control lists that restrict management plane connectivity
Enable enhanced audit logging on affected CLI operations to detect exploitation attempts
Implement multi-factor authentication for all accounts capable of accessing the CLI interface