CVE-2026-73772: AOS-CX Buffer Overflow Vulnerability

CVE-2026-73772 Overview

CVE-2026-73772 identifies buffer overflow vulnerabilities in an underlying service of HPE Aruba Networking AOS-CX. An unauthenticated attacker on an adjacent network can send specially crafted packets to trigger the flaw. Successful exploitation disrupts normal operation of the underlying operating system, producing a denial-of-service condition on the affected switch.

The weakness is tracked under CWE-120: Buffer Copy without Checking Size of Input. The issue impacts availability only; confidentiality and integrity are not affected. HPE published a security advisory describing the affected AOS-CX versions and fixes.

Critical Impact
An unauthenticated adjacent-network attacker can crash an AOS-CX switch by sending crafted packets, interrupting network operations for downstream systems.

Affected Products

HPE Aruba Networking AOS-CX network operating system
AOS-CX switches running the affected underlying service
See the HPE Security Advisory for the authoritative list of impacted versions

Discovery Timeline

2026-09-01 - CVE-2026-73772 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73772

Vulnerability Analysis

AOS-CX is the network operating system that powers HPE Aruba Networking CX-series switches. The vulnerability resides in an underlying service that processes network packets on the switch. When the service parses attacker-supplied input, it copies data into a fixed-size buffer without adequate bounds checking.

The overflow corrupts adjacent memory and destabilizes the process. HPE describes the outcome as a disruption of the underlying operating system. The attacker does not need credentials, and no user interaction is required. Exploitation is limited to the adjacent network, meaning the attacker must have Layer 2 access or a foothold on a directly reachable network segment.

Because the impact is restricted to availability, the vulnerability does not enable code execution or data theft based on currently published information. However, an outage of a core switch can cascade into broader operational impact for connected workloads.

Root Cause

The root cause is classic unchecked buffer copy behavior mapped to [CWE-120]. The vulnerable routine trusts the length or structure of incoming packet fields and writes past the allocated buffer. Malformed field lengths or oversized payloads therefore overwrite memory that the parser relies on to continue execution.

Attack Vector

The attack vector is Adjacent Network. An attacker sends crafted packets to the management or data plane service on a directly connected network segment. No authentication, credentials, or user interaction are required. Repeated exploitation can produce a sustained denial-of-service condition against the switch.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The EPSS data available at publication indicates a low near-term exploitation probability. Refer to the HPE Security Advisory for protocol-level details.

Detection Methods for CVE-2026-73772

Indicators of Compromise

Unexpected reboots, process crashes, or watchdog restarts on AOS-CX switches
Loss of management-plane responsiveness followed by service recovery cycles
Bursts of malformed or truncated packets sourced from adjacent Layer 2 segments
Interface flaps and control-plane protocol resets that align with anomalous packet activity

Detection Strategies

Correlate switch syslog and SNMP trap output for repeated daemon restarts or kernel-level exceptions on the underlying service
Baseline normal packet composition on management VLANs and alert on anomalous field lengths or protocol violations
Cross-reference switch availability events with adjacent-segment packet captures to identify crafted traffic patterns

Monitoring Recommendations

Forward AOS-CX logs, sFlow, and NetFlow telemetry to a central analytics platform for continuous review
Monitor uptime counters and control-plane process health metrics on every AOS-CX device
Track authentication and access events on switch management interfaces to detect adjacent-network reconnaissance preceding exploitation

How to Mitigate CVE-2026-73772

Immediate Actions Required

Review the HPE Security Advisory and identify AOS-CX versions in scope within your environment
Schedule upgrades to the fixed AOS-CX releases published by HPE Aruba Networking
Restrict Layer 2 reachability to switch management interfaces using dedicated out-of-band VLANs
Enforce control-plane policing and storm control to limit the impact of malformed packet floods

Patch Information

HPE Aruba Networking has released fixed AOS-CX firmware for affected switches. Consult the vendor advisory for the specific patched versions that correspond to each product family and apply them following standard change-management procedures. No workaround from the vendor is listed as a substitute for the fix; upgrading is the definitive remediation.

Workarounds

Isolate the management plane on a dedicated VLAN with strict access control lists
Apply port security and MAC filtering on access ports to limit which devices can reach the vulnerable service
Deploy control-plane ACLs that drop packets from untrusted adjacent segments before they reach the affected parser
Monitor for repeated crashes and fail over to redundant switches while patching is in progress

bash

# Configuration example - restrict management plane access on AOS-CX
# Replace values with those matching your environment
configure terminal
 access-list ip MGMT-PLANE-PROTECT
  10 permit tcp 10.0.0.0/24 any
  20 deny any any count
 interface mgmt
  ip access-group MGMT-PLANE-PROTECT in
end
write memory