CVE-2026-73767: AOS-CX Command Injection RCE Vulnerability

CVE-2026-73767 Overview

CVE-2026-73767 is an authenticated command injection vulnerability in the command line interface (CLI) of HPE Aruba Networking AOS-CX. An authenticated attacker with high privileges can inject operating system commands through the CLI and execute them as a privileged user on the underlying operating system. The flaw is categorized under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). Successful exploitation grants full compromise of the switch operating system, including confidentiality, integrity, and availability impacts on the affected network device.

Critical Impact
Authenticated attackers can escape the CLI sandbox and execute arbitrary commands as a privileged user on the underlying AOS-CX operating system.

Affected Products

HPE Aruba Networking AOS-CX (switches running AOS-CX firmware)
Refer to the HPE Security Bulletin for the specific affected versions
Vendor advisory identifier: hpesbnw05134en_us

Discovery Timeline

2026-09-01 - CVE-2026-73767 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73767

Vulnerability Analysis

The vulnerability resides in the AOS-CX command line interface, which parses administrator-supplied arguments before passing them to underlying system utilities. Input passed through specific CLI commands is not properly neutralized before being incorporated into an OS command string. An authenticated user with sufficient CLI privileges can append shell metacharacters or additional commands to legitimate arguments. The injected commands execute in the context of the underlying operating system with privileged rights, effectively bypassing the restricted CLI shell. Because AOS-CX runs the network operating system that governs switch forwarding and management, code execution at this layer allows persistence, configuration tampering, and lateral pivots into the management network.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. CLI handlers construct shell commands using unsanitized user input, allowing metacharacters such as ;, |, `, or $() to break out of the intended argument boundary. Missing input validation and the absence of parameterized command execution enable the injection.

Attack Vector

Exploitation requires network access to the AOS-CX management interface and valid administrative credentials on the switch. The attacker authenticates through SSH, console, or another supported management channel, then issues a crafted CLI command that embeds shell metacharacters. No user interaction beyond the attacker's own session is required. Because the flaw depends on authenticated access, exposure is largely determined by the strength of management-plane access controls and credential hygiene.

No verified public proof-of-concept has been published for CVE-2026-73767. Consult the HPE Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2026-73767

Indicators of Compromise

CLI command history entries containing shell metacharacters such as ;, |, &&, $(), or backticks in argument fields that normally accept only alphanumeric input
Unexpected child processes spawned by AOS-CX management daemons on the switch
New or modified files in writable filesystem paths outside standard configuration directories
Outbound network connections from the switch management interface to unfamiliar hosts

Detection Strategies

Ingest AOS-CX accounting, authentication, and command-audit logs into a centralized SIEM and alert on CLI arguments containing shell metacharacters
Baseline normal administrator command patterns and flag deviations, especially long or obfuscated argument strings
Correlate administrative logins from unusual source IPs or off-hours sessions with subsequent privileged CLI activity

Monitoring Recommendations

Forward TACACS+ or RADIUS accounting records for every CLI command executed on AOS-CX devices
Monitor SNMP and streaming telemetry for unexpected configuration changes or process anomalies
Track failed and successful administrative authentications and alert on brute-force patterns targeting switch management interfaces

How to Mitigate CVE-2026-73767

Immediate Actions Required

Apply the AOS-CX firmware update referenced in the HPE Security Bulletin as soon as maintenance windows allow
Restrict management-plane access to a dedicated out-of-band network and a minimal set of jump hosts
Rotate administrative credentials and enforce multi-factor authentication for CLI access where supported
Audit existing local accounts and remove unused or shared privileged users

Patch Information

HPE has published fixed firmware for AOS-CX in security bulletin hpesbnw05134en_us. Review the bulletin for the exact fixed release trains that apply to each hardware platform and upgrade all affected switches. Confirm the running version after upgrade using show version on each device.

Workarounds

Limit CLI access to trusted administrators via role-based access control and command authorization policies enforced through TACACS+
Place switch management interfaces on an isolated VLAN reachable only from hardened administrative jump hosts
Enforce command accounting so every CLI invocation is logged to an external, tamper-resistant collector
Disable unused management services and interfaces to reduce the authenticated attack surface

bash

# Example: restrict AOS-CX management access to a dedicated subnet
ssh server vrf mgmt
access-list ip MGMT_ACL
    10 permit tcp 10.10.0.0/24 any eq ssh
    20 deny tcp any any eq ssh
apply access-list ip MGMT_ACL control-plane vrf mgmt