CVE-2026-73773: AOS-CX API Denial-of-Service Vulnerability

CVE-2026-73773 Overview

CVE-2026-73773 is an unauthenticated Denial-of-Service (DoS) vulnerability in the API endpoint of HPE Aruba Networking AOS-CX. A remote attacker can interrupt normal operation of the affected service without authentication or user interaction. The weakness is classified as Uncontrolled Resource Consumption [CWE-400], allowing adversaries to exhaust resources on the switch operating system and disrupt network availability.

Critical Impact
An unauthenticated attacker with network access to the AOS-CX API endpoint can disrupt switch service availability, impacting network operations that depend on the affected device.

Affected Products

HPE Aruba Networking AOS-CX (see vendor advisory for affected versions)
Switches running vulnerable AOS-CX firmware with the API endpoint reachable
Refer to the HPE Security Advisory for the authoritative product and version matrix

Discovery Timeline

2026-09-01 - CVE-2026-73773 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73773

Vulnerability Analysis

The vulnerability resides in the API endpoint exposed by AOS-CX. When the endpoint receives specifically crafted requests, resource consumption on the device is not properly bounded. This allows a remote, unauthenticated attacker to interrupt normal operation of the affected service.

AOS-CX is the network operating system for HPE Aruba Networking CX switches. Disruption of its management or data-plane services can affect connected clients, upstream routing, and dependent security controls. The Common Weakness Enumeration [CWE-400] applies: Uncontrolled Resource Consumption.

Root Cause

The underlying flaw is improper resource management in the API request handling path. The service does not sufficiently limit or validate incoming requests, so an attacker can trigger conditions that exhaust CPU, memory, or connection resources. The vendor advisory contains additional technical detail about the affected component.

Attack Vector

Exploitation requires network reachability to the AOS-CX API endpoint. No credentials and no user interaction are required. Attackers typically deliver malformed or high-volume requests to the API to induce the denial-of-service condition. Devices with management interfaces exposed to untrusted networks face elevated risk.

No public proof-of-concept, exploit code, or reports of exploitation in the wild are currently associated with this CVE. The EPSS probability at publication is low, reflecting limited observed exploitation activity.

Refer to the HPE Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-73773

Indicators of Compromise

Unexpected restarts, service crashes, or unresponsiveness of the AOS-CX management API or dependent services.
Spikes in inbound traffic to the switch management interface, particularly to REST API TCP ports.
Repeated malformed HTTP/HTTPS requests originating from a single or small set of source IP addresses.
Loss of network connectivity or protocol adjacency flaps coinciding with the events above.

Detection Strategies

Correlate switch syslog, SNMP traps, and NetFlow/sFlow data to identify volumetric or malformed traffic aimed at the management API.
Alert on API response latency degradation and process restart events emitted by AOS-CX.
Build baselines for normal API request rates and flag statistically significant deviations.

Monitoring Recommendations

Forward AOS-CX syslog, authentication logs, and API access logs to a centralized SIEM for correlation and long-term retention.
Continuously monitor availability of management interfaces with active health checks.
Track inbound connections to management VLANs and alert on any traffic that originates outside authorized administrative subnets.

How to Mitigate CVE-2026-73773

Immediate Actions Required

Apply the fixed AOS-CX version identified in the HPE Security Advisory as soon as maintenance windows permit.
Restrict access to the AOS-CX API endpoint to trusted management subnets using access control lists.
Inventory all AOS-CX switches and identify any with management interfaces reachable from user or untrusted networks.

Patch Information

HPE has published a security advisory that lists affected AOS-CX releases and fixed versions. Consult the HPE Security Advisory (hpesbnw05134en_us) for the definitive remediation and upgrade path.

Workarounds

Place management interfaces on a dedicated out-of-band management VLAN unreachable from production or user networks.
Apply control-plane policing and management-plane ACLs to rate-limit and filter traffic destined for the API endpoint.
Disable the REST API on devices where it is not operationally required.
Enforce network segmentation so that only authorized administrative hosts can initiate connections to switch management services.

bash

# Example: restrict AOS-CX REST API access to a trusted management subnet
access-list ip mgmt-api
    10 permit tcp 10.10.0.0/24 any eq 443
    20 deny  tcp any any eq 443
    30 permit any any

interface mgmt
    apply access-list ip mgmt-api in

# Disable HTTPS server on devices that do not require the REST API
no https-server rest access-mode read-write