CVE-2026-73757: AOS-CX SSRF Vulnerability

CVE-2026-73757 Overview

CVE-2026-73757 is a Server-Side Request Forgery (SSRF) vulnerability in the web-based management interface of HPE Aruba Networking AOS-CX. An authenticated remote attacker can abuse the interface to issue requests from the AOS-CX host to internal resources. Successful exploitation allows enumeration of the internal structure of the AOS-CX host and can lead to disclosure and limited modification of sensitive information. The weakness is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot through the AOS-CX management interface to reach internal services, disclose sensitive information, and perform limited modifications.

Affected Products

HPE Aruba Networking AOS-CX (see the HPE Security Bulletin for affected versions)
Switching platforms running vulnerable AOS-CX firmware releases
Web-based management interface component of AOS-CX

Discovery Timeline

2026-09-01 - CVE-2026-73757 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73757

Vulnerability Analysis

The vulnerability resides in the web-based management interface of AOS-CX. The interface accepts user-supplied input that is later used to construct server-side HTTP requests without adequate validation of the destination. An authenticated attacker with low privileges can direct the AOS-CX host to make requests to arbitrary endpoints reachable from the device. Because the request originates from the switch itself, it can reach management-plane resources and adjacent internal services that are not directly exposed to the attacker. The scope changes from the vulnerable component to other resources, enabling limited disclosure and modification of sensitive information.

Root Cause

The root cause is insufficient validation and allow-listing of destination URLs processed by the management interface [CWE-918]. The interface trusts attacker-influenced input when initiating outbound requests, allowing redirection to internal addresses, loopback services, and metadata endpoints. Vendor details are available in the HPE Security Bulletin.

Attack Vector

Exploitation is network-based and requires valid credentials on the AOS-CX management interface. The attacker submits crafted requests that cause the management service to fetch or interact with attacker-chosen URLs. No user interaction is required. The attacker uses response content, timing, or error signaling to enumerate internal services, retrieve configuration or telemetry data, and perform limited state changes on reachable internal endpoints.

No verified proof-of-concept code is publicly available. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-73757

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests originating from the AOS-CX management interface to internal RFC1918 addresses or loopback.
Management interface access logs showing authenticated sessions issuing requests with URL parameters pointing to internal hosts.
Anomalous DNS resolutions initiated by the switch management plane for internal service names.
Configuration or telemetry access patterns inconsistent with the account's normal operator role.

Detection Strategies

Inspect AOS-CX web management access logs for parameters containing full URLs, IP literals, or localhost/127.0.0.1 references.
Correlate authenticated management sessions with outbound flows leaving the switch management VRF.
Alert on management-plane connections to metadata addresses or internal APIs that the switch should not contact.
Baseline normal administrative behavior and flag deviations in request destinations and response sizes.

Monitoring Recommendations

Forward AOS-CX authentication and web management logs to a centralized SIEM for correlation and retention.
Enable flow logging on the management VRF and review outbound connections initiated by the switch.
Monitor account activity for low-privilege operator accounts performing unusual URL-parameterized requests.
Track configuration changes made through the web interface and reconcile them with change-management records.

How to Mitigate CVE-2026-73757

Immediate Actions Required

Apply the fixed AOS-CX firmware version identified in the HPE Security Bulletin.
Restrict access to the AOS-CX web-based management interface to trusted administrative networks only.
Rotate credentials for management accounts and audit account privileges to enforce least privilege.
Review recent management interface logs for evidence of SSRF probing prior to patching.

Patch Information

HPE has published remediation guidance in the HPE Security Bulletin. Administrators should upgrade AOS-CX to the vendor-specified fixed release. Verify the running firmware version after upgrade and confirm the management interface no longer accepts arbitrary destination URLs.

Workarounds

Disable the web-based management interface where CLI or out-of-band management is sufficient.
Enforce management access control lists that restrict the interface to a dedicated administrative subnet.
Segment the management VRF so the switch cannot reach sensitive internal services or cloud metadata endpoints.
Require multi-factor authentication and strong password policies for all management accounts.

bash

# Example: restrict AOS-CX web management access via ACL and management VRF
configure terminal
access-list ip MGMT_ACL
  10 permit tcp 10.10.10.0/24 any eq 443
  20 deny  tcp any any eq 443
  30 permit any any
exit
interface mgmt
  ip access-group MGMT_ACL in
  vrf attach mgmt
exit
https-server vrf mgmt
write memory