CVE-2026-73752: AOS-CX API RCE Vulnerability

CVE-2026-73752 Overview

CVE-2026-73752 is an unauthenticated arbitrary file write vulnerability in an API endpoint of HPE Aruba Networking AOS-CX. An attacker on an adjacent network can write arbitrary files to the underlying operating system without any authentication or user interaction. Successful exploitation can lead to remote code execution on affected switches. The vulnerability is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and affects the switch management plane exposed through the AOS-CX REST API.

Critical Impact
Unauthenticated attackers with adjacent network access can plant files on the switch operating system and pivot to full remote code execution on core network infrastructure.

Affected Products

HPE Aruba Networking AOS-CX (see HPE Security Advisory for the version matrix)
Aruba CX series switches running vulnerable AOS-CX firmware
Management interfaces exposing the AOS-CX REST API on adjacent network segments

Discovery Timeline

2026-09-01 - CVE-2026-73752 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73752

Vulnerability Analysis

AOS-CX is the network operating system that powers HPE Aruba CX switches. The platform exposes a REST API for programmatic configuration and telemetry. CVE-2026-73752 exists in one of these API endpoints, which fails to enforce authentication and does not properly restrict file path parameters. An attacker on an adjacent Layer 2 or Layer 3 segment can send crafted API requests that cause the switch to write attacker-controlled content to arbitrary locations on the underlying Linux-based operating system.

Because the write primitive lands on the switch OS with elevated privileges, an attacker can drop startup scripts, replace configuration files, or overwrite binaries referenced by scheduled processes. Each of these paths converts the file write into remote code execution on the switch control plane. Compromise at this layer allows traffic interception, VLAN pivoting, and disruption of the entire routed environment.

Root Cause

The root cause is a path traversal weakness [CWE-22] combined with missing authentication on the affected API endpoint. The endpoint accepts a file path or filename parameter and concatenates it into a destination on disk without canonicalization or allow-list validation. Sequences such as ../ traverse outside the intended directory, and the absence of an authentication check means no session, token, or credential is required to reach the vulnerable code path.

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must reach the switch management API from a directly connected network segment rather than the public internet. In practice this includes any host on the management VLAN, a compromised device on the same broadcast domain, or a system that has already pivoted into the network fabric. No privileges and no user interaction are required. The attacker sends a single crafted HTTP request to the vulnerable API endpoint with a traversal-laden path and a payload body, and the switch writes the file. Refer to the HPE Security Advisory for endpoint-specific details.

Detection Methods for CVE-2026-73752

Indicators of Compromise

Unexpected files or modified system binaries under AOS-CX filesystem paths such as /etc/, /var/, or startup script directories.
HTTP requests to the AOS-CX REST API containing path traversal sequences (../, encoded %2e%2e%2f) in URI parameters or JSON bodies.
New or modified cron entries, systemd units, or boot scripts on the switch that were not deployed through the standard configuration workflow.
Unexplained switch reboots, daemon restarts, or configuration drift on Aruba CX devices.

Detection Strategies

Inspect AOS-CX API access logs for unauthenticated requests reaching file-handling endpoints, particularly requests originating from non-management hosts.
Enable and forward AOS-CX audit logs and syslog to a central collector, then alert on API calls that include filesystem path parameters.
Baseline switch firmware and configuration hashes, and alert on any deviation between the running image and the vendor-signed image.

Monitoring Recommendations

Deploy network-layer monitoring on management VLANs to flag HTTP or HTTPS traffic to switch REST APIs from unauthorized sources.
Forward switch telemetry into a centralized analytics platform such as Singularity Data Lake for correlation with endpoint and identity events.
Alert on any first-seen source address communicating with AOS-CX API endpoints.

How to Mitigate CVE-2026-73752

Immediate Actions Required

Apply the AOS-CX firmware update listed in the HPE Security Advisory to all Aruba CX switches.
Restrict the AOS-CX REST API to a dedicated out-of-band management network and block it from user VLANs.
Audit switch filesystems and running configurations for unauthorized files or modifications since the CVE publication date.
Rotate credentials, API tokens, and certificates stored on any switch that may have been exposed.

Patch Information

HPE has released fixed AOS-CX firmware versions. Consult the HPE Security Advisory (hpesbnw05134en_us) for the exact fixed builds mapped to each switch model and AOS-CX train. Upgrade all affected devices and verify the running image after reboot.

Workarounds

Disable the AOS-CX REST API on switches where it is not required for automation or monitoring.
Apply management-plane ACLs that permit API access only from a defined list of orchestration and NMS hosts.
Enforce segmentation so that user, guest, and IoT VLANs cannot route to the switch management interface.
Require mutual TLS or IPsec on the management path where the platform supports it.

bash

# Example AOS-CX management ACL restricting REST API access
configure terminal
access-list ip MGMT-API
    10 permit tcp 10.10.0.0/24 any eq 443
    20 deny  tcp any any eq 443
    30 permit any any any
apply access-list ip MGMT-API control-plane vrf mgmt
write memory