CVE-2026-63454 Overview
CVE-2026-63454 is an authenticated path traversal vulnerability [CWE-22] in HPE Aruba Networking AOS-CX. An authenticated attacker can abuse the command line interface (CLI) to copy arbitrary files from the underlying operating system to a user-readable location. Because sensitive OS-level files become accessible outside their intended directory scope, exploitation can escalate to remote code execution on the affected switch. The flaw requires network access and valid high-privilege credentials, but no user interaction.
Critical Impact
Authenticated attackers can copy arbitrary files from the underlying operating system through the AOS-CX CLI, potentially achieving remote code execution on network switches.
Affected Products
- HPE Aruba Networking AOS-CX (refer to the vendor advisory for affected versions)
- AOS-CX switch platforms exposing the affected CLI copy functionality
- Refer to the HPE Security Advisory for the complete product and version matrix
Discovery Timeline
- 2026-07-21 - CVE-2026-63454 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-63454
Vulnerability Analysis
AOS-CX exposes CLI file operations that fail to properly sanitize path components before performing file copy actions on the underlying operating system. An authenticated user with sufficient CLI privileges can supply crafted path arguments containing traversal sequences. The switch operating system then resolves those sequences and copies files residing outside the intended directory into a location the user can read.
The attacker leverages this primitive to exfiltrate configuration files, credential stores, private keys, or binaries used by system services. When writable OS locations are reachable through the same primitive, the attacker can stage a payload and achieve remote code execution with the privileges of the affected process. The EPSS probability is 0.547% (percentile 42.5) as of 2026-07-23.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The CLI handler accepts file path arguments without normalizing or validating them against an allow-list of permitted directories. Traversal sequences such as parent-directory references pass through to the OS-level copy routine unchecked.
Attack Vector
Exploitation is network-based and requires authenticated access with high privileges to the AOS-CX management plane. The attacker invokes the vulnerable CLI copy command with a path argument containing directory traversal segments. See the HPE Security Advisory for technical details specific to the affected command syntax.
Detection Methods for CVE-2026-63454
Indicators of Compromise
- CLI audit log entries showing copy commands containing traversal sequences such as ../ or absolute paths pointing outside standard user directories
- Unexpected file reads of sensitive OS artifacts (private keys, shadow files, service binaries) surfaced through CLI activity
- Administrative sessions from unusual source addresses executing file copy operations shortly after login
Detection Strategies
- Enable and centralize AOS-CX CLI command accounting through TACACS+ or RADIUS, then alert on copy command arguments containing .., /etc/, or other sensitive path fragments
- Correlate authenticated management-plane sessions with subsequent file transfer operations to identify staging behavior
- Baseline legitimate administrator use of CLI file operations and flag deviations, especially copies targeting non-configuration paths
Monitoring Recommendations
- Forward AOS-CX syslog and command accounting records to a centralized SIEM for retention and query
- Monitor management interfaces for authentication anomalies that precede file copy activity, including brute-force attempts and credential reuse
- Alert on any outbound transfer of files copied through the CLI to external TFTP, SFTP, or SCP destinations
How to Mitigate CVE-2026-63454
Immediate Actions Required
- Apply the AOS-CX firmware update referenced in the HPE Security Advisory as soon as maintenance windows allow
- Restrict management-plane access to a dedicated out-of-band network and an allow-list of administrator source addresses
- Rotate credentials for any account with CLI privileges on affected switches, including TACACS+/RADIUS shared secrets
- Audit CLI command history on affected devices for evidence of traversal patterns prior to patching
Patch Information
HPE has published fixed AOS-CX firmware versions in the HPE Security Advisory (document ID hpesbnw05081en_us). Consult the advisory for the exact fixed builds corresponding to each affected AOS-CX release train and apply the upgrade path recommended by HPE.
Workarounds
- Limit CLI access to the minimum set of trusted administrators and enforce role-based access control so operator accounts cannot invoke privileged file copy commands
- Disable or restrict remote management protocols on untrusted interfaces and require jump-host access with multi-factor authentication
- Enable full command accounting so any attempted exploitation is logged and can be reviewed post-incident
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
