CVE-2026-73762: AOS-CX API Authentication Bypass Vulnerability

CVE-2026-73762 Overview

CVE-2026-73762 is an access control weakness [CWE-284] in the Application Programming Interface (API) endpoint of HPE Aruba Networking AOS-CX. A remote authenticated actor can circumvent configured access control policies through the API. Successful exploitation grants unauthorized access to management functionality that administrators intended to restrict.

The flaw affects the enforcement layer that validates whether an authenticated principal is permitted to invoke specific management operations. Because the network attack vector requires only high privileges and low complexity, an existing operator account can expand its effective authority on the switch.

Critical Impact
An authenticated remote actor can bypass access controls on AOS-CX API endpoints and reach management functionality outside their authorized scope, undermining role separation on affected switches.

Affected Products

HPE Aruba Networking AOS-CX (versions listed in the HPE security bulletin)
Aruba CX switches running vulnerable AOS-CX firmware
Management interfaces exposing the AOS-CX REST API

Discovery Timeline

2026-09-01 - CVE-2026-73762 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73762

Vulnerability Analysis

AOS-CX exposes a REST API for switch configuration, telemetry, and operational tasks. The vulnerability resides in how this API endpoint evaluates authorization for incoming requests. According to the HPE advisory, the endpoint does not consistently apply the configured access control policy, allowing a remote actor to reach management functions that should be gated by role or ACL enforcement.

The issue is scoped as an authorization boundary failure rather than an authentication failure. The requester must already hold valid credentials on the device. Once authenticated, the actor can invoke API operations that the platform's role-based access control (RBAC) model was configured to deny.

Because the CVSS scope is marked as changed, the impact crosses a trust boundary: actions taken through the API can affect resources or configurations governed by a different security authority on the switch. This has direct implications for tenant isolation, operator role separation, and least-privilege enforcement on shared network fabrics.

Root Cause

The root cause is improper access control [CWE-284] within the AOS-CX API request handler. Authorization checks are either missing or incorrectly evaluated for specific management endpoints, so policy decisions do not reflect the administrator-defined restrictions.

Attack Vector

Exploitation requires network reachability to the switch management API and valid credentials with elevated privileges on the device. An operator with restricted role assignment issues crafted API requests to endpoints that should be blocked by policy. The API processes the request without correctly rejecting it, exposing management functionality beyond the actor's authorized scope.

See the HPE Security Bulletin for the technical description and affected version list.

Detection Methods for CVE-2026-73762

Indicators of Compromise

API requests from authenticated operator accounts targeting management endpoints outside their assigned role scope.
Configuration changes recorded in AOS-CX audit logs that were performed by accounts lacking the corresponding administrative role.
Successful HTTP 2xx responses on REST API paths that policy should reject for the requesting user.

Detection Strategies

Correlate AOS-CX audit and authentication logs against the configured RBAC matrix to surface role/action mismatches.
Baseline normal API usage per operator account and alert on deviations to unfamiliar endpoints or configuration objects.
Monitor for unexpected use of write-oriented API calls originating from accounts provisioned as read-only or limited-scope users.

Monitoring Recommendations

Forward AOS-CX syslog, REST API access logs, and TACACS+/RADIUS accounting to a centralized SIEM for correlation.
Alert on any privilege-relevant configuration changes (users, roles, ACLs, management interfaces) outside authorized change windows.
Track EPSS scoring for CVE-2026-73762 over time; the current EPSS probability is 0.219% and prioritization should follow environmental exposure of the management plane.

How to Mitigate CVE-2026-73762

Immediate Actions Required

Apply the fixed AOS-CX firmware version identified in the HPE Security Bulletin as soon as a maintenance window permits.
Restrict management API access to a dedicated out-of-band management network or jump hosts.
Review and reduce accounts holding elevated AOS-CX roles to the minimum required for operations.

Patch Information

HPE Aruba Networking has published fixed AOS-CX versions in security bulletin hpesbnw05134en_us. Consult the bulletin to map each deployed AOS-CX train to its remediated release, then schedule upgrades based on device exposure and role in the network.

Workarounds

Enforce management-plane ACLs that limit REST API reachability to trusted administrative subnets.
Disable the REST API on switches where it is not operationally required until patches are applied.
Rotate credentials for privileged AOS-CX accounts and audit recent API activity for unauthorized management operations.

bash

# Example: restrict AOS-CX REST API access to a management subnet
switch(config)# access-list ip MGMT-API
switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq 443
switch(config-acl-ip)# 20 deny tcp any any eq 443
switch(config)# https-server vrf mgmt
switch(config)# apply access-list ip MGMT-API control-plane vrf mgmt