CVE-2026-73770: AOS-CX Privilege Escalation Vulnerability

CVE-2026-73770 Overview

CVE-2026-73770 is an authenticated arbitrary file write vulnerability in HPE Aruba Networking AOS-CX. An authenticated attacker on an adjacent network can create or modify arbitrary files on the underlying operating system. Successful exploitation requires interaction from another user and specific environmental conditions outside the attacker's direct control. When these conditions are met, the attacker can execute arbitrary commands as a privileged user. The vulnerability is classified under CWE-73: External Control of File Name or Path.

Critical Impact
An authenticated attacker with high privileges on an adjacent network can achieve arbitrary command execution as a privileged user on AOS-CX switches, compromising confidentiality, integrity, and availability of the network device.

Affected Products

HPE Aruba Networking AOS-CX
HPE Aruba Networking switches running vulnerable AOS-CX firmware versions
Refer to the HPE Security Bulletin for the specific affected releases

Discovery Timeline

2026-09-01 - CVE-2026-73770 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73770

Vulnerability Analysis

The vulnerability in AOS-CX allows an authenticated user to influence file paths used by privileged operations. By supplying attacker-controlled path input, the actor can direct write operations to arbitrary locations on the switch's underlying operating system. Because the write executes in a privileged context, the attacker can drop or overwrite files consumed by higher-privileged processes. This leads to arbitrary command execution as a privileged user once the required secondary user action occurs.

Root Cause

The root cause is external control of a file name or path, tracked as CWE-73. AOS-CX accepts input that is used to construct file system paths without sufficient validation or canonicalization. The application trusts attacker-influenced values for file destinations, allowing traversal or redirection outside intended directories. Combined with privileged file system access on the underlying OS, this design weakness enables the observed integrity impact.

Attack Vector

Exploitation requires network adjacency, high privileges, and user interaction, which raises attack complexity. An authenticated attacker submits crafted input through an AOS-CX interface that constructs file paths. A separate user must then perform an action that triggers the vulnerable code path. The written file is later consumed by a privileged process, resulting in command execution across a scope change on the affected switch. Because AOS-CX runs the control plane for network infrastructure, successful exploitation affects downstream systems that trust the compromised switch.

No verified public exploit or proof-of-concept code is available for CVE-2026-73770 at the time of publication. See the HPE Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-73770

Indicators of Compromise

Unexpected file creation or modification on AOS-CX switches, particularly in system, configuration, or script directories
Configuration or script files with recent timestamps that do not correlate with authorized change windows
Authenticated management sessions from adjacent-network hosts that immediately precede unusual file system activity
Privileged command execution originating from files or scripts not present in vendor-signed baselines

Detection Strategies

Baseline the file system state of AOS-CX switches and alert on deviations in privileged directories
Correlate administrative authentication events on switches with subsequent write operations to sensitive paths
Inspect AOS-CX audit logs for uncommon CLI or API calls that reference user-supplied file paths
Monitor for privileged process invocations that consume files written by lower-privileged authenticated sessions

Monitoring Recommendations

Forward AOS-CX syslog, authentication, and audit events to a centralized SIEM for retention and correlation
Alert on management-plane access from unexpected VLANs, subnets, or jump hosts on the adjacent network
Track configuration change events and compare running configuration hashes against known-good baselines
Review privileged account usage on network devices and enforce alerting on out-of-hours administrative activity

How to Mitigate CVE-2026-73770

Immediate Actions Required

Apply the AOS-CX firmware update referenced in the HPE Security Bulletin as soon as maintenance windows allow
Restrict management-plane access to dedicated, isolated administrative networks and jump hosts
Rotate credentials for privileged AOS-CX accounts and audit which users hold high-privilege roles
Review recent switch configuration changes and file system state for signs of unauthorized modification

Patch Information

HPE has published fixed AOS-CX firmware versions in security bulletin hpesbnw05134en_us. Consult the HPE Security Bulletin for the specific firmware releases that address CVE-2026-73770 and for platform-specific upgrade guidance. Apply the vendor-recommended version that matches each deployed switch model and current train.

Workarounds

Limit AOS-CX management access to trusted administrators using role-based access control and least-privilege assignments
Place switch management interfaces on an out-of-band network unreachable from user VLANs
Enforce multi-factor authentication and centralized authentication (TACACS+ or RADIUS) for all administrative access
Disable unused management protocols and services on AOS-CX to reduce the exposed attack surface

bash

# Example: restrict AOS-CX management access to an admin subnet
switch(config)# access-list ip mgmt-acl
switch(config-acl-ip)# 10 permit tcp 10.10.10.0/24 any eq ssh
switch(config-acl-ip)# 20 deny any any any
switch(config)# interface mgmt
switch(config-if-mgmt)# ip access-group mgmt-acl in