CVE-2026-73758: AOS-CX API Privilege Escalation Flaw

CVE-2026-73758 Overview

CVE-2026-73758 is a privilege escalation vulnerability in the API endpoint of HPE Aruba Networking AOS-CX. An authenticated low-privilege operator user can modify the state of certain settings on a vulnerable system by sending crafted requests to the affected API endpoint. The flaw is classified under CWE-269: Improper Privilege Management and is exploitable over the network without user interaction.

Critical Impact
An authenticated operator-level account can alter configuration settings that should require administrative privileges, undermining the integrity of switch configuration and role-based access control on AOS-CX devices.

Affected Products

HPE Aruba Networking AOS-CX (see HPE Security Bulletin for specific versions)
ArubaOS-CX switch platforms exposing the affected management API endpoint
Deployments where low-privilege operator accounts are provisioned for delegated management

Discovery Timeline

2026-09-01 - CVE-2026-73758 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73758

Vulnerability Analysis

AOS-CX exposes a management API used by administrators and operator-role accounts for switch configuration and monitoring. The affected endpoint fails to correctly enforce role-based authorization before applying configuration changes. As a result, requests from an authenticated operator account are accepted and processed even when the requested action falls outside the operator role's intended privilege boundary.

The impact is limited to system integrity. An attacker can change specific settings but cannot read confidential data through this flaw and cannot directly cause a denial-of-service condition. The exploitability requires prior authentication as a valid low-privilege user, which reduces the pool of viable attackers to insiders, compromised operator accounts, or networks with weak credential hygiene.

Root Cause

The root cause is improper privilege management [CWE-269] within the AOS-CX API authorization layer. The endpoint validates that the caller is authenticated but does not correctly verify that the caller's assigned role permits the specific configuration change being requested. This is a missing or incomplete server-side authorization check on privileged operations.

Attack Vector

Exploitation is network-based and requires valid operator credentials on the target switch. An attacker with a low-privilege operator session sends an API request to the vulnerable endpoint targeting a configuration setting normally restricted to higher-privilege roles. The device processes the request and applies the change, granting the attacker effective privileges beyond those assigned to the operator role. No user interaction is required. Refer to the HPE Security Bulletin for endpoint-specific technical details.

Detection Methods for CVE-2026-73758

Indicators of Compromise

Unexpected configuration changes on AOS-CX switches attributed to operator-role accounts in device audit logs.
API requests from operator sessions targeting endpoints or parameters normally reserved for administrator roles.
Sudden divergence between the running configuration and the last known-good baseline without a corresponding administrator change record.

Detection Strategies

Enable and forward AOS-CX audit logs and REST API access logs to a centralized SIEM for correlation.
Build detection rules that alert when an operator-role user issues API calls resulting in configuration state changes on protected settings.
Perform periodic configuration drift analysis by comparing running configurations against a signed baseline.

Monitoring Recommendations

Continuously monitor authentication events for operator accounts, including source IP, session duration, and API call volume.
Alert on anomalous API request patterns such as high-frequency configuration write operations from non-administrative accounts.
Track privileged setting modifications and require change-management ticket correlation for every accepted change.

How to Mitigate CVE-2026-73758

Immediate Actions Required

Apply the fixed AOS-CX firmware version identified in the HPE Security Bulletin as soon as maintenance windows allow.
Audit all operator-role accounts and disable any that are unused, shared, or protected by weak credentials.
Restrict management-plane access to trusted administrative subnets using ACLs on the management VRF.

Patch Information

HPE Aruba Networking has published remediation guidance in bulletin hpesbnw05134en_us. Consult the HPE Security Bulletin for the list of fixed AOS-CX firmware versions and upgrade paths applicable to your switch platform. No public proof-of-concept exploit or CISA KEV listing is associated with this CVE at publication time.

Workarounds

Limit or remove operator-role account provisioning on switches that do not require delegated management.
Enforce strong, unique passwords and multi-factor authentication for any accounts with API access.
Segregate the switch management interface on an out-of-band network reachable only from administrative jump hosts.

bash

# Example: restrict AOS-CX management access to a trusted subnet
configure terminal
access-list ip MGMT_ACL
    10 permit tcp 10.10.0.0/24 any eq 443
    20 deny  tcp any any eq 443
    30 permit any any any
apply access-list ip MGMT_ACL control-plane vrf mgmt
exit