CVE-2026-73760 Overview
CVE-2026-73760 is an authenticated path traversal vulnerability [CWE-22] in HPE Aruba Networking AOS-CX. The flaw resides in the web-based management interface. An authenticated attacker can traverse directory boundaries to read arbitrary files from the underlying operating system. Successful exploitation exposes sensitive configuration data, credentials, and system files that support further compromise of the switching infrastructure.
Critical Impact
An authenticated remote attacker can read arbitrary files from AOS-CX switches through the management interface, exposing credentials and configuration data that enable lateral movement.
Affected Products
- HPE Aruba Networking AOS-CX (see vendor advisory for affected versions)
- AOS-CX web-based management interface
- Refer to the HPE Security Document for the complete list
Discovery Timeline
- 2026-09-01 - CVE-2026-73760 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-73760
Vulnerability Analysis
The vulnerability affects the web-based management interface of AOS-CX, the network operating system that powers HPE Aruba Networking switches. An attacker with valid low-privileged credentials can supply crafted path input to a management endpoint. The interface fails to normalize and validate the requested path before opening the file on the underlying operating system.
As a result, the process reads files outside the intended directory scope. Attackers can retrieve switch configuration files, stored credentials, certificate material, session data, and operating system files readable by the web service account. The vulnerability does not permit modification of files, but disclosed contents commonly enable follow-on attacks such as credential replay, TACACS+/RADIUS abuse, or pivoting into managed network segments.
Root Cause
The root cause is insufficient sanitization of user-supplied path components in a request handler on the management interface. Sequences such as ../ or absolute paths are passed through to file system APIs without canonicalization or containment checks against an allow-listed base directory, which matches the CWE-22 pattern.
Attack Vector
Exploitation requires network reachability to the AOS-CX management interface and valid authenticated credentials. An attacker submits a crafted HTTP request containing traversal sequences in a parameter that references a resource on disk. The server resolves the path outside the intended directory and returns the file contents in the response. No user interaction is required, and the attack complexity is low.
No verified public proof-of-concept is available at the time of publication. See the HPE Security Document for vendor technical details.
Detection Methods for CVE-2026-73760
Indicators of Compromise
- HTTP requests to the AOS-CX management interface containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute file paths in query parameters or request bodies.
- Web server access logs showing successful 200 responses to unusual file resource requests from authenticated management sessions.
- Retrieval of sensitive file paths such as /etc/passwd, /etc/shadow, or AOS-CX configuration and credential stores in response bodies.
- Authenticated sessions performing sequential file read operations that deviate from normal administrative workflows.
Detection Strategies
- Deploy web application firewall or intrusion detection signatures that flag path traversal patterns in requests destined for switch management interfaces.
- Correlate AOS-CX audit logs with network telemetry to identify low-privileged accounts issuing file-read requests outside expected administrative activity.
- Baseline normal management-interface traffic per account and alert on anomalies in URI structure, response size, or resource access frequency.
Monitoring Recommendations
- Forward AOS-CX management, authentication, and web access logs to a centralized SIEM for correlation and long-term retention.
- Alert on any authentication event from unexpected source networks or service accounts accessing the switch web UI.
- Review privileged account inventories on network devices and monitor for credential reuse across switching, routing, and identity infrastructure.
How to Mitigate CVE-2026-73760
Immediate Actions Required
- Apply the AOS-CX firmware update referenced in the HPE Security Document on all affected switches.
- Restrict access to the AOS-CX web management interface to a dedicated out-of-band management network or jump-host subnet.
- Rotate any credentials, certificates, or shared secrets that may have been readable from the affected devices.
- Audit accounts with access to the switch management interface and remove unused or over-privileged accounts.
Patch Information
HPE has published a security bulletin for CVE-2026-73760. Consult the HPE Security Document for the fixed AOS-CX versions and upgrade guidance corresponding to each affected switch platform.
Workarounds
- Disable the web-based management interface where CLI or API-based management is sufficient for operations.
- Enforce access control lists on the management VRF or interface to permit only trusted administrator source addresses.
- Require multi-factor authentication in front of the management network through a bastion host or zero-trust gateway.
- Increase logging verbosity on the management interface and forward events to a monitored log pipeline until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
