CVE-2026-73754: AOS-CX CLI Denial of Service Vulnerability

CVE-2026-73754 Overview

CVE-2026-73754 identifies denial-of-service vulnerabilities in the command line interface (CLI) of HPE Aruba Networking AOS-CX. An authenticated user with low privileges can issue crafted CLI input that disrupts normal operation of a vulnerable switch. Successful exploitation impacts availability of the affected system without exposing or altering data.

The issue is tracked under CWE-400: Uncontrolled Resource Consumption. HPE published details in the HPE Security Bulletin.

Critical Impact
An authenticated attacker can disrupt normal switch operation on AOS-CX devices, degrading availability of network infrastructure that depends on the affected platform.

Affected Products

HPE Aruba Networking AOS-CX (see vendor bulletin for affected versions)
Switches running vulnerable AOS-CX firmware
Management-plane CLI accessible via network sessions

Discovery Timeline

2026-09-01 - CVE-2026-73754 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73754

Vulnerability Analysis

The vulnerability resides in the AOS-CX command line interface. An authenticated user can submit input that the CLI fails to bound or validate, causing resource exhaustion or a process fault. The result is a denial-of-service condition affecting the availability of the switch.

The CWE-400 classification points to uncontrolled resource consumption. Exploitation requires network reachability to the management plane and valid credentials at a low privilege level. No confidentiality or integrity impact is reported; the outcome is limited to service disruption.

Because AOS-CX runs on core and aggregation switches, a disruption to a single device can propagate to dependent segments, VLANs, or routed paths. Operators should treat management-plane availability as part of the blast radius when scoping impact.

Root Cause

The root cause is improper handling of CLI input that leads to unbounded resource use or a fatal condition in the CLI process. HPE has not published low-level technical details beyond the security bulletin. See the HPE Security Bulletin for authoritative version and component information.

Attack Vector

The attack vector is network based and requires authentication. An attacker with SSH or console-equivalent access can trigger the condition through crafted CLI commands. Attack complexity is high, meaning the attacker must satisfy specific conditions to reliably reproduce the fault. No user interaction is required.

Proof-of-concept code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is low.

Detection Methods for CVE-2026-73754

Indicators of Compromise

Unexpected CLI process crashes or restarts on AOS-CX switches
Sudden loss of management-plane responsiveness following authenticated sessions
CPU or memory spikes on the switch control plane correlated with CLI activity
Repeated abnormal command sequences originating from a single authenticated session

Detection Strategies

Forward AOS-CX syslog and process telemetry to a centralized SIEM for correlation with authentication events
Alert on CLI process termination, watchdog resets, and management-plane restarts
Baseline normal administrator CLI usage patterns and flag deviations such as long or malformed command strings

Monitoring Recommendations

Monitor AAA and TACACS+ logs for accounts issuing commands prior to device instability
Track SNMP availability metrics and interface state changes tied to control-plane recovery events
Review session recordings or command accounting for the interval preceding any DoS event

How to Mitigate CVE-2026-73754

Immediate Actions Required

Review the HPE Security Bulletin and inventory AOS-CX devices against listed fixed versions
Apply vendor-provided AOS-CX firmware updates on all affected switches following change management procedures
Restrict CLI access to a minimum set of trusted administrators and jump hosts
Rotate credentials for any account that no longer requires switch access

Patch Information

HPE has published fixed firmware and remediation guidance in the security bulletin. Refer to the HPE Security Bulletin for specific fixed AOS-CX versions and upgrade paths applicable to your hardware family.

Workarounds

Enforce management-plane access control lists that permit only authorized management subnets
Use out-of-band management networks to isolate CLI access from user VLANs
Enable role-based access control (RBAC) to limit low-privilege accounts from executing non-essential commands
Enable command accounting through TACACS+ or RADIUS to attribute activity to individual operators