CVE-2026-73759: AOS-CX Denial-of-Service Vulnerability

CVE-2026-73759 Overview

CVE-2026-73759 is a denial-of-service vulnerability in HPE Aruba Networking AOS-CX. An unauthenticated attacker on an adjacent network can send specially crafted packets to disrupt normal operation of affected switches. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. Successful exploitation results in service disruption on the targeted device, impacting network availability for downstream systems.

The vulnerability requires no authentication and no user interaction, but the attacker must have logical access to the same broadcast or layer-2 segment as the target. Confidentiality and integrity remain unaffected, while availability impact is high.

Critical Impact
Adjacent-network attackers can trigger denial-of-service on AOS-CX switches without authentication, disrupting network operations for connected hosts and services.

Affected Products

HPE Aruba Networking AOS-CX (specific affected versions listed in the HPE Security Bulletin)
AOS-CX-based switching platforms
Refer to vendor advisory for exact hardware and firmware coverage

Discovery Timeline

2026-09-01 - CVE-2026-73759 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73759

Vulnerability Analysis

The vulnerability resides in AOS-CX packet processing logic. When the switch receives specially crafted packets on an adjacent network interface, resource handling fails to enforce proper limits or validation. This leads to uncontrolled resource consumption, degrading or halting normal device operation.

The attack does not require authentication, credentials, or user interaction. An attacker attached to the same layer-2 segment as the target switch can transmit malicious frames directly to a management or data-plane interface. The result is disruption of switching functions, potentially affecting all clients relying on the device.

HPE has published a security advisory documenting the issue and fixed software versions. See the HPE Security Bulletin for authoritative product and version data.

Root Cause

The root cause maps to [CWE-400] Uncontrolled Resource Consumption. AOS-CX fails to properly bound resource usage when parsing or handling specific malformed packet structures. Repeated or single crafted packets can exhaust processing capacity, memory, or another finite resource on the switch.

Attack Vector

Exploitation requires adjacent-network access. The attacker must reside on the same broadcast domain, VLAN, or directly connected link as the vulnerable switch. Remote exploitation across routed boundaries is not possible. No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the HPE Security Bulletin for technical details.

Detection Methods for CVE-2026-73759

Indicators of Compromise

Unexpected reboots, watchdog resets, or process crashes recorded in AOS-CX system logs
Sudden spikes in CPU or memory utilization on switch control-plane processes
Loss of management-plane responsiveness (SSH, REST API, or console timeouts) coinciding with unusual traffic on adjacent interfaces
Interface counters showing bursts of malformed or unexpected protocol frames

Detection Strategies

Forward AOS-CX syslog and SNMP trap data to a centralized log platform and alert on repeated process restarts or availability transitions
Baseline control-plane CPU and memory usage per switch, then alert on statistical deviations
Deploy network telemetry (sFlow, IPFIX) to identify anomalous layer-2 traffic patterns targeting switch interfaces

Monitoring Recommendations

Enable and retain AOS-CX event logs for forensic review after any availability incident
Correlate switch health metrics with adjacent-host network activity in a SIEM to identify localized attackers
Monitor for repeated device unavailability events across switches sharing common VLANs

How to Mitigate CVE-2026-73759

Immediate Actions Required

Review the HPE Security Bulletin and inventory AOS-CX devices against the fixed version list
Schedule upgrade windows for affected switches to the patched AOS-CX release identified by HPE
Restrict physical and logical access to switch management VLANs and data-plane ports where feasible

Patch Information

HPE has released updated AOS-CX firmware addressing CVE-2026-73759. Consult the HPE Security Bulletin for the exact fixed versions applicable to each switch model. Apply the vendor-supplied firmware through standard AOS-CX upgrade procedures.

Workarounds

Segment untrusted hosts away from switches using dedicated VLANs and enforce port security on access interfaces
Apply control-plane policing (CoPP) and access control lists on management interfaces to limit exposure to crafted packets
Disable unused switch protocols and services on edge ports to reduce the attack surface