CVE-2026-73755: AOS-CX API Privilege Escalation Vulnerability

CVE-2026-73755 Overview

CVE-2026-73755 is a privilege escalation vulnerability in the API endpoint of HPE Aruba Networking AOS-CX. An authenticated low-privilege operator user can access sensitive information from the affected system after a required user action. The flaw is categorized under CWE-269: Improper Privilege Management.

Exploitation requires valid operator credentials and user interaction, which limits opportunistic abuse. However, successful exploitation grants read access to information that should remain restricted to higher-privileged roles.

Critical Impact
An authenticated operator-level attacker can retrieve confidential data from AOS-CX switches through the API, undermining role-based access controls on network infrastructure.

Affected Products

HPE Aruba Networking AOS-CX (refer to the HPE Security Bulletin for specific versions)

Discovery Timeline

2026-09-01 - CVE-2026-73755 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73755

Vulnerability Analysis

The vulnerability resides in an API endpoint exposed by AOS-CX, the operating system that powers HPE Aruba Networking campus and data center switches. The API fails to enforce privilege boundaries correctly, allowing an authenticated operator user to reach data intended for administrator-level roles.

AOS-CX defines multiple built-in user roles, including operator and administrator. Operators are expected to have read-only visibility into a limited subset of switch state. This vulnerability breaks that guarantee for at least one API path, exposing confidential configuration or runtime information.

The attack requires the network attack vector, low attacker privileges, and user interaction. The impact is confined to confidentiality; integrity and availability are not affected.

Root Cause

The root cause is improper privilege management [CWE-269] within the API authorization logic. The endpoint validates authentication but does not correctly verify that the caller's role is authorized to read the requested resource. Role-based access controls therefore fail closed only for some paths and open for the affected endpoint.

Attack Vector

An attacker must first obtain valid operator credentials, whether through credential theft, insider access, or reuse of shared accounts. The attacker then triggers a required user action, such as inducing an administrator or another user to interact with a crafted request or resource. Once the precondition is met, the attacker queries the vulnerable API endpoint and receives sensitive data in the response.

Because the attack vector is network-based, exploitation can occur from any host that reaches the switch management interface. Environments that expose the AOS-CX API to broader management VLANs or jump hosts increase the accessible attack surface.

No public proof-of-concept code, exploit module, or in-the-wild exploitation has been reported. Technical specifics are documented in the HPE Security Bulletin.

Detection Methods for CVE-2026-73755

Indicators of Compromise

API requests to AOS-CX endpoints originating from accounts with the operator role that return unusually large or sensitive response payloads.
Repeated authenticated API calls from a single operator session enumerating configuration or state endpoints.
Session activity that combines operator credentials with requests targeting resources normally accessed only by administrator accounts.

Detection Strategies

Enable AOS-CX audit logging for REST API access and forward logs to a centralized SIEM for correlation across switches.
Baseline normal API usage per role, then alert on operator accounts issuing requests that deviate from the baseline scope or volume.
Correlate operator API activity with administrator sessions occurring in the same window to identify the required user-action precondition.

Monitoring Recommendations

Monitor the management plane for authentication events from operator accounts, especially outside change windows.
Track API response sizes and status codes per endpoint to surface anomalous data retrieval patterns.
Alert on any operator role attempting to access endpoints that historically respond only to administrator credentials.

How to Mitigate CVE-2026-73755

Immediate Actions Required

Apply the fixed AOS-CX release identified in the HPE Security Bulletin as soon as it is validated in a test environment.
Audit all operator accounts and disable or rotate credentials for accounts that are unused, shared, or over-provisioned.
Restrict access to the AOS-CX management interface and REST API to a dedicated, tightly controlled management network.

Patch Information

HPE has published fixed versions and remediation guidance in the HPE Security Bulletin (hpesbnw05134en_us). Consult the bulletin for the specific AOS-CX branches and patched builds applicable to your hardware platforms.

Workarounds

Limit REST API access using access control lists so that only trusted management hosts can reach the API endpoint.
Enforce least privilege by removing operator role assignments from users who do not require them and by using per-user accounts rather than shared logins.
Require administrative approval and multi-factor authentication for any account permitted to authenticate to the AOS-CX management plane.

bash

# Example: restrict REST API access on AOS-CX to a management subnet
switch(config)# access-list ip mgmt-api-acl
switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq 443
switch(config-acl-ip)# 20 deny tcp any any eq 443
switch(config-acl-ip)# exit
switch(config)# https-server vrf mgmt
switch(config)# apply access-list ip mgmt-api-acl control-plane vrf mgmt