CVE-2026-73771: AOS-CX Management Interface Auth Bypass

CVE-2026-73771 Overview

CVE-2026-73771 is an authentication vulnerability in the HPE Aruba Networking AOS-CX management interface and application programming interface (API). The flaw enables improper authentication processing on the network switch operating system. An unauthenticated remote attacker can exploit the weakness under specific conditions to bypass authentication controls or exhaust system resources. Successful exploitation results in unauthorized access to the management plane or denial of service against network infrastructure devices. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact
An unauthenticated remote attacker can bypass authentication on the AOS-CX management interface or exhaust switch resources, leading to unauthorized administrative access or denial of service on core network devices.

Affected Products

HPE Aruba Networking AOS-CX (management interface)
HPE Aruba Networking AOS-CX API
Refer to the HPE Security Bulletin for the complete list of affected switch models and firmware versions

Discovery Timeline

2026-09-01 - CVE-2026-73771 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73771

Vulnerability Analysis

CVE-2026-73771 affects the authentication layer of AOS-CX, the network operating system that powers HPE Aruba data-center and campus switches. The management interface and API perform improper authentication processing when handling specific request sequences. Under those conditions, the authentication path either accepts requests it should reject or allocates resources without proper limits. The result is a dual-impact flaw covering both integrity and availability.

Because the flaw resides in the management plane, exploitation targets the control channel used by administrators. Compromise here grants attackers control-plane visibility over switching, routing, and access-control configurations.

Root Cause

The root cause is improper authentication [CWE-287] in the AOS-CX management interface and API request-handling logic. The authentication routine does not correctly validate credentials or session state before dispatching privileged operations, and it does not adequately bound resource consumption while processing authentication requests. HPE has not published deeper root-cause details in the public advisory.

Attack Vector

The attack vector is network-based and does not require prior authentication. However, exploitation requires specific preconditions and some user interaction, which raises attack complexity. An attacker with network reachability to the AOS-CX management interface or API endpoint sends crafted requests to the affected service. Depending on the timing and content of those requests, the attacker either bypasses authentication and gains access to management functions, or triggers excessive resource use that degrades or halts the management plane.

No public proof-of-concept exploit is available at the time of publication, and CVE-2026-73771 is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS estimate for near-term exploitation activity is low.

See the HPE Security Bulletin for vendor-specific technical guidance.

Detection Methods for CVE-2026-73771

Indicators of Compromise

Unexpected successful logins to the AOS-CX management interface or REST API from unknown source addresses
Bursts of malformed or repeated authentication requests to the switch management IP
Sudden spikes in CPU or memory utilization on AOS-CX management daemons without a corresponding configuration change
New or modified administrative accounts, session tokens, or configuration commits with no matching change-management record

Detection Strategies

Alert on AOS-CX authentication events where the source address is outside approved management subnets or jump-host ranges
Correlate failed and successful authentication events on the same session to surface bypass patterns
Monitor REST API access logs for atypical endpoints, high request rates, or unusual user-agent strings targeting the management API
Baseline management-plane resource metrics and alert on deviations that coincide with authentication traffic

Monitoring Recommendations

Forward AOS-CX syslog, AAA, and REST API audit logs to a centralized analytics platform for retention and correlation
Enable TACACS+ or RADIUS accounting so every management action is attributed to an identity, not just a session
Track configuration diffs on switches and alert on changes made outside approved change windows
Continuously monitor management-plane reachability and CPU/memory health to detect resource-exhaustion attempts early

How to Mitigate CVE-2026-73771

Immediate Actions Required

Apply the fixed AOS-CX firmware versions identified in the HPE Security Bulletin as soon as your change window permits
Restrict access to the AOS-CX management interface and REST API to a dedicated out-of-band management network or jump hosts
Rotate administrative credentials and API tokens on affected switches after patching
Audit recent authentication and configuration events on all AOS-CX devices for signs of unauthorized access

Patch Information

HPE Aruba Networking has published fixed firmware for AOS-CX. Consult the HPE Security Bulletin hpesbnw05134en_us for the exact fixed versions per switch model and upgrade guidance. Prioritize patching switches that expose the management interface to broader network segments.

Workarounds

Enforce management-plane access control lists (ACLs) that permit only known administrative source IPs to reach the management interface and REST API
Disable the REST API on switches where it is not operationally required
Require multi-factor authentication on the identity provider fronting TACACS+ or RADIUS for switch administrators
Place switch management interfaces on a dedicated out-of-band VLAN isolated from user and server traffic

bash

# Example: restrict AOS-CX management access to trusted subnets
# Consult HPE documentation for exact syntax on your firmware version
switch(config)# access-list ip MGMT_ACL
switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq 443
switch(config-acl-ip)# 20 permit tcp 10.10.0.0/24 any eq 22
switch(config-acl-ip)# 30 deny  any any any
switch(config)# https-server vrf mgmt
switch(config)# https-server acl MGMT_ACL vrf mgmt
switch(config)# ssh access-list ip MGMT_ACL vrf mgmt