CVE-2026-73765: AOS-CX Path Traversal Vulnerability

CVE-2026-73765 Overview

CVE-2026-73765 is an authenticated path traversal vulnerability affecting API endpoints in HPE Aruba Networking AOS-CX. An attacker with high-privileged authentication can abuse improperly sanitized path parameters to write arbitrary files to the underlying operating system. Successful exploitation can lead to remote code execution on affected switches, compromising confidentiality, integrity, and availability.

The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. HPE published details in the HPE Security Advisory.

Critical Impact
Arbitrary file write from an authenticated API session can lead to remote code execution on AOS-CX switches, providing persistent control over core network infrastructure.

Affected Products

HPE Aruba Networking AOS-CX (refer to the HPE Security Advisory for specific fixed versions)
AOS-CX switches exposing the affected API endpoints
Deployments where high-privileged API credentials are provisioned for automation or management

Discovery Timeline

2026-09-01 - CVE-2026-73765 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73765

Vulnerability Analysis

The vulnerability resides in AOS-CX API endpoints that accept file path parameters from authenticated clients. The endpoints fail to canonicalize and validate supplied paths before performing write operations. An attacker can supply traversal sequences such as ../ to escape the intended directory and target arbitrary locations on the underlying Linux-based operating system.

Because the API runs with elevated privileges on the switch, arbitrary file write extends to sensitive locations. Writing to startup scripts, configuration files, or executable paths enables remote code execution. The attacker requires valid administrative or equivalent high-privileged credentials, limiting opportunistic exploitation but not preventing insider abuse or credential compromise scenarios.

Root Cause

The root cause is [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The affected API handlers concatenate user-supplied input into file system paths without normalizing traversal sequences or enforcing an allow-list of destination directories. This design flaw allows the write primitive to reach outside the intended sandbox.

Attack Vector

Exploitation requires network access to the AOS-CX management API and valid high-privileged credentials. The attacker authenticates, then issues an API request whose path parameter contains directory traversal sequences pointing to a sensitive file. The API writes attacker-controlled content to that location. Chaining this write with an executable path or startup hook yields code execution in the switch operating system context. Refer to the HPE Security Advisory for endpoint-specific technical details.

Detection Methods for CVE-2026-73765

Indicators of Compromise

API requests containing traversal patterns such as ../, ..%2f, or encoded variants in path or filename parameters
Unexpected file modifications outside standard AOS-CX configuration or firmware directories
New or altered startup scripts, cron entries, or systemd unit files on the switch
Administrative sessions originating from unusual source IPs or at unusual times immediately preceding configuration changes

Detection Strategies

Enable API and REST access logging on AOS-CX and forward logs to a centralized analytics platform for inspection
Alert on API payloads containing traversal sequences or non-standard file paths
Baseline legitimate administrative API usage and flag deviations in endpoint, parameter, or credential patterns

Monitoring Recommendations

Continuously monitor privileged account activity on network infrastructure, including token issuance and API session duration
Correlate switch configuration changes with change-management tickets to detect unauthorized modifications
Ingest AOS-CX syslog and audit events into a SIEM or data lake for retention and long-horizon threat hunting

How to Mitigate CVE-2026-73765

Immediate Actions Required

Apply the fixed AOS-CX firmware version referenced in the HPE Security Advisory as soon as maintenance windows permit
Rotate all administrative and API credentials on AOS-CX devices, particularly service accounts used by automation
Restrict API access to a dedicated out-of-band management network and trusted jump hosts
Audit recent API activity and file system state on switches for signs of prior exploitation

Patch Information

HPE has published fixed firmware versions for AOS-CX. Consult the HPE Security Advisory for the exact versions that remediate CVE-2026-73765 and any dependency on switch platform or release train.

Workarounds

Limit AOS-CX API access to a minimum set of authorized management hosts using ACLs and management VRF isolation
Enforce role-based access control to reduce the number of accounts holding write-capable API privileges
Require multi-factor authentication for administrative access to management systems that hold AOS-CX credentials
Disable API access on devices that do not require programmatic management until patches are applied

bash

# Example: restrict AOS-CX REST API access to trusted management hosts
switch(config)# access-list ip MGMT_API_ACL
switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq 443
switch(config-acl-ip)# 20 deny tcp any any eq 443
switch(config)# https-server vrf mgmt
switch(config)# apply access-list ip MGMT_API_ACL control-plane vrf mgmt