CVE-2026-73766: AOS-CX API Command Injection RCE Vulnerability

CVE-2026-73766 Overview

CVE-2026-73766 is a command injection vulnerability in the API endpoint of HPE Aruba Networking AOS-CX. An authenticated remote attacker with administrative privileges can inject arbitrary operating system commands through the affected API. Successful exploitation executes commands as a privileged user on the underlying operating system, breaking the isolation between the network operating system's management plane and the host.

The issue is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. While exploitation requires administrative credentials, successful attacks convert switch management access into full host-level command execution.

Critical Impact
Authenticated administrators can execute arbitrary commands on the underlying operating system of AOS-CX network devices, escalating beyond intended management-plane boundaries.

Affected Products

HPE Aruba Networking AOS-CX (see the HPE Security Bulletin for the definitive affected version list)
AOS-CX API endpoint component
AOS-CX-managed switching platforms exposing the REST API

Discovery Timeline

2026-09-01 - CVE-2026-73766 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73766

Vulnerability Analysis

The vulnerability resides in an AOS-CX API endpoint that accepts input later incorporated into a command executed by the underlying operating system. The endpoint fails to neutralize shell metacharacters and command separators before passing parameters to the OS. An authenticated administrator can append arbitrary commands to legitimate API parameters and have them executed by the host.

AOS-CX exposes management functionality through a REST API. When user-supplied values reach a system call without proper sanitization or use of safe execution primitives, attackers can inject characters such as ;, |, &&, or backticks to break out of the intended command context. The result is arbitrary command execution in the privilege context of the API worker process.

Because the attacker already holds administrative credentials, the practical value of exploitation is a boundary crossing: from switch configuration authority to shell-level control of the network operating system host. This enables persistence, log tampering, and pivoting deeper into management networks.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-77]. The affected API handler concatenates untrusted input into a command string rather than using parameterized execution or a strict allowlist of shell-safe values.

Attack Vector

Exploitation occurs over the network against the AOS-CX management API. The attacker authenticates with valid administrative credentials, then submits a crafted API request containing shell metacharacters within a vulnerable parameter. No user interaction is required. Consult the HPE Security Bulletin for endpoint specifics and affected parameters.

Detection Methods for CVE-2026-73766

Indicators of Compromise

Unexpected child processes spawned by AOS-CX API service accounts on the switch host
API request bodies or query strings containing shell metacharacters such as ;, |, `, $(, or &&
Outbound connections from switch management interfaces to unfamiliar hosts
Modifications to system binaries, cron entries, or startup scripts on AOS-CX devices

Detection Strategies

Log and inspect all AOS-CX REST API requests, flagging parameters containing shell control characters
Correlate administrative API sessions with any subsequent process execution on the device host
Baseline normal administrator API usage and alert on deviations in endpoint, frequency, or payload structure
Monitor for authentication anomalies preceding suspicious API calls, since exploitation requires valid admin credentials

Monitoring Recommendations

Forward AOS-CX syslog, audit, and API access logs to a centralized SIEM with retention sufficient for forensic review
Alert on any command-line activity on switch hosts that does not match approved firmware or management processes
Track administrative credential usage across the network fleet to identify credential compromise or misuse
Review privileged account inventories and remove stale or unused administrator accounts on AOS-CX devices

How to Mitigate CVE-2026-73766

Immediate Actions Required

Apply the fixed AOS-CX firmware version listed in the HPE Security Bulletin as soon as maintenance windows permit
Restrict AOS-CX API access to a dedicated management network reachable only from authorized administrator workstations
Rotate administrative credentials on all AOS-CX devices and audit for unauthorized administrator accounts
Enable and review API audit logging to identify prior exploitation attempts

Patch Information

HPE has published fixed firmware for affected AOS-CX releases. Refer to the HPE Security Bulletin hpesbnw05134en_us for the authoritative list of fixed versions and upgrade guidance. Patch all managed AOS-CX devices, prioritizing those with API exposure beyond the management VLAN.

Workarounds

Disable the AOS-CX REST API on devices where it is not required for operations
Enforce network-layer access control lists that limit API reachability to specific administrative source addresses
Require multi-factor authentication on administrative accounts used for switch management to reduce credential misuse risk
Apply least-privilege role assignments so fewer accounts hold the administrative privilege required to reach the vulnerable endpoint

bash

# Example: restrict AOS-CX REST API access to a management subnet
# Consult AOS-CX documentation for exact syntax on your platform version
configure terminal
  https-server vrf mgmt
  no https-server vrf default
  access-list ip MGMT_API
    10 permit tcp 10.10.0.0/24 any eq 443
    20 deny  tcp any any eq 443
  interface mgmt
    ip access-group MGMT_API in
end
write memory