CVE-2026-73764: AOS-CX Switches Auth Bypass Vulnerability

CVE-2026-73764 Overview

CVE-2026-73764 is an authentication bypass vulnerability in the operating system of HPE Aruba Networking AOS-CX switches. An unauthenticated actor on an adjacent network can circumvent existing authentication controls. Successful exploitation can enable unauthorized modification of affected resources and cause limited disruption to affected services. The weakness is classified as Improper Authentication [CWE-287].

Critical Impact
An adjacent-network attacker can bypass authentication on AOS-CX switches, modify device resources, and disrupt switching services without valid credentials.

Affected Products

HPE Aruba Networking AOS-CX switch operating system
Refer to the HPE Security Bulletin for the full list of affected switch models and firmware versions

Discovery Timeline

2026-09-01 - CVE-2026-73764 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73764

Vulnerability Analysis

The vulnerability resides in authentication logic within the AOS-CX operating system that powers HPE Aruba Networking switches. An attacker on an adjacent network segment can send crafted traffic that bypasses the switch's authentication controls. The flaw does not expose sensitive data, but it does permit unauthorized changes to switch resources and can degrade switching services in a limited manner.

Because AOS-CX switches sit in the network fabric, an authentication bypass on the management or control plane can alter forwarding behavior, VLAN membership, or access-control policy. This provides a foothold for lateral movement and traffic manipulation in enterprise and data center environments.

Root Cause

The root cause is improper authentication [CWE-287] in AOS-CX. Specific code paths accept requests without correctly verifying the requester's identity, allowing protected operations to execute for callers who should have been rejected. HPE has not published the low-level implementation details in the public advisory.

Attack Vector

The attack vector is adjacent network, meaning the attacker must be on the same broadcast domain or a directly connected Layer 2/3 segment as the target switch. No prior authentication and no user interaction are required. Exploitation targets integrity primarily and availability secondarily, with no direct impact on confidentiality.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.213%.

See the HPE Security Bulletin for vendor-supplied technical detail.

Detection Methods for CVE-2026-73764

Indicators of Compromise

Unexpected configuration changes on AOS-CX switches, including modifications to VLANs, ACLs, routing, or user accounts, that do not correlate with authorized change tickets.
Management-plane sessions or API calls sourced from adjacent hosts that should not administer the switch.
Authentication or audit log gaps where privileged operations appear without a preceding successful login event.

Detection Strategies

Forward AOS-CX syslog, AAA, and REST API audit logs to a central SIEM and alert on privileged operations that lack an associated authenticated session.
Baseline expected management sources (jump hosts, NMS, TACACS+/RADIUS servers) and alert on control-plane traffic from any other adjacent host.
Monitor switch running-config hashes and diff them against a known-good version to detect unauthorized modifications.

Monitoring Recommendations

Enable and centralize AOS-CX event logs with full command accounting through TACACS+ or RADIUS.
Track adjacent-network scanning of management protocols such as SSH, HTTPS, and NETCONF on switch management interfaces and VLANs.
Correlate switch configuration changes with change-management records to surface out-of-band edits quickly.

How to Mitigate CVE-2026-73764

Immediate Actions Required

Inventory all HPE Aruba Networking AOS-CX switches and identify firmware versions listed as affected in the HPE Security Bulletin.
Apply the AOS-CX firmware updates published by HPE as soon as they can be scheduled through change management.
Restrict management-plane access to a dedicated out-of-band VLAN or management network reachable only from authorized administrative hosts.

Patch Information

HPE has published fixed AOS-CX firmware versions in security bulletin hpesbnw05134en_us. Consult the HPE Security Bulletin for the exact patched versions that map to each affected switch model and upgrade path.

Workarounds

Enforce management-interface ACLs that permit only trusted administrative subnets to reach SSH, HTTPS, REST, and NETCONF services on the switch.
Segment user and IoT VLANs from switch management VLANs to reduce the pool of hosts capable of reaching the vulnerable authentication surface.
Disable unused management protocols and services on AOS-CX devices to shrink the exposed attack surface until patches are applied.

bash

# Example: restrict AOS-CX management access to a trusted admin subnet
switch(config)# access-list ip MGMT-ACL
switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq ssh
switch(config-acl-ip)# 20 permit tcp 10.10.0.0/24 any eq https
switch(config-acl-ip)# 30 deny  tcp any any eq ssh
switch(config-acl-ip)# 40 deny  tcp any any eq https
switch(config)# interface mgmt
switch(config-if-mgmt)# ip access-group MGMT-ACL in