CVE-2026-73756: AOS-CX API Information Disclosure Flaw

CVE-2026-73756 Overview

CVE-2026-73756 is an information disclosure vulnerability affecting an API endpoint in HPE Aruba Networking AOS-CX. A remote unauthenticated attacker positioned to intercept network traffic can obtain sensitive information via a man-in-the-middle (MITM) attack. Successful exploitation retrieves data that an attacker can use to further compromise the confidentiality of the affected system.

The issue is categorized under CWE-319: Cleartext Transmission of Sensitive Information. It stems from insufficient protection of data transmitted between the API endpoint and its clients, enabling exposure when an attacker intercepts the network path.

Critical Impact
An attacker with a network position between an AOS-CX device and its API client can capture sensitive data traversing the API endpoint and reuse it to broaden system compromise.

Affected Products

HPE Aruba Networking AOS-CX (see HPE Security Bulletin for affected versions)
AOS-CX API endpoint component
AOS-CX-managed switches exposing the vulnerable API endpoint

Discovery Timeline

2026-09-01 - CVE-2026-73756 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73756

Vulnerability Analysis

The vulnerability resides in an API endpoint of AOS-CX that does not sufficiently protect data in transit. When an attacker occupies a network position between the API client and the AOS-CX device, the attacker can intercept, observe, and potentially manipulate the traffic. The exposed data can then be leveraged to escalate access or pivot further into the managed network.

Exploitation requires the attacker to be network-adjacent or otherwise able to intercept traffic between endpoints. This raises attack complexity, since the adversary must first achieve an interception position through techniques such as ARP spoofing, rogue gateway insertion, DNS redirection, or upstream traffic manipulation.

The attacker gains no direct write access to the device from this flaw alone. However, the disclosed data can include credentials, tokens, or configuration material that supports subsequent attacks against management planes or downstream systems.

Root Cause

The root cause is cleartext or otherwise inadequately protected transmission of sensitive information from the AOS-CX API endpoint. Under [CWE-319], the product transmits data over a channel that can be observed by an unauthorized actor. This includes cases where certificate validation, cipher enforcement, or transport hardening is missing or optional.

Attack Vector

The attack vector is network based. An unauthenticated remote attacker must intercept traffic between a legitimate API client and the AOS-CX device. Once positioned, the attacker passively captures the API exchange and extracts sensitive fields returned by or sent to the vulnerable endpoint. Refer to the HPE Security Bulletin for endpoint-specific technical details.

Detection Methods for CVE-2026-73756

Indicators of Compromise

Unexpected TLS downgrade events or certificate mismatches on sessions destined for AOS-CX management interfaces.
ARP table anomalies or duplicate MAC-to-IP mappings on VLANs carrying switch management traffic.
API traffic to AOS-CX endpoints traversing unexpected hops, proxies, or asymmetric paths.
Repeated short-lived sessions from unusual client addresses to the AOS-CX API port.

Detection Strategies

Inspect management-plane flows for plaintext or weakly encrypted traffic to AOS-CX API endpoints and alert on any non-TLS or downgraded sessions.
Correlate ARP, DHCP, and neighbor discovery logs to identify spoofing or rogue gateway activity on management VLANs.
Baseline the set of authorized API clients and flag connections originating from unknown source addresses or user agents.

Monitoring Recommendations

Enable and centralize AOS-CX audit and authentication logs for review of API access patterns.
Monitor certificate fingerprints on AOS-CX API endpoints and alert on unexpected changes.
Track NetFlow or IPFIX records for management VLANs to detect off-path interception attempts.

How to Mitigate CVE-2026-73756

Immediate Actions Required

Review the HPE Security Bulletin and apply the fixed AOS-CX version to all affected switches.
Restrict AOS-CX API access to a dedicated, isolated management network reachable only by authorized administrative hosts.
Enforce strict TLS with certificate pinning or validation on all API clients that interact with AOS-CX.
Rotate any credentials, API tokens, or keys that may have traversed the vulnerable endpoint prior to patching.

Patch Information

HPE has published remediation guidance in the HPE Security Bulletin (hpesbnw05134en_us). Administrators should consult the bulletin for the list of affected AOS-CX versions and the corresponding fixed releases, then upgrade according to HPE's documented procedure.

Workarounds

Segment management traffic onto an out-of-band network with no exposure to user or untrusted VLANs.
Require API access to AOS-CX only through hardened jump hosts using mutually authenticated TLS.
Deploy Dynamic ARP Inspection, DHCP Snooping, and IPv6 First-Hop Security on switches that carry AOS-CX management traffic to reduce MITM opportunities.
Disable or firewall any AOS-CX API endpoint that is not operationally required until patches are applied.

bash

# Example: restrict AOS-CX REST/API access to a management subnet
# (adapt to your AOS-CX version and CLI syntax; consult HPE documentation)
configure terminal
  https-server vrf mgmt
  https-server rest access-mode read-write
  access-list ip MGMT_API_ONLY
    10 permit tcp 10.10.0.0/24 any eq 443
    20 deny tcp any any eq 443
    30 permit any any any
  interface mgmt
    apply access-list ip MGMT_API_ONLY in
end
write memory