CVE-2026-73775 Overview
CVE-2026-73775 is an information disclosure vulnerability in the API endpoint of HPE Aruba Networking AOS-CX. A remote attacker authenticated with low privileges can query the affected API and retrieve sensitive information. The exposed data can be reused to expand access to network services supported by AOS-CX switches.
The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The vulnerability has a changed scope, meaning the impact reaches components beyond the vulnerable API itself.
Critical Impact
Authenticated low-privilege attackers can extract sensitive configuration and operational data from AOS-CX switches, enabling lateral movement into network services managed by the affected devices.
Affected Products
- HPE Aruba Networking AOS-CX (API endpoint component)
- Refer to the HPE Support Document for the full list of affected switch platforms and firmware versions
Discovery Timeline
- 2026-09-01 - CVE-2026-73775 published to the National Vulnerability Database
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-73775
Vulnerability Analysis
The vulnerability resides in an API endpoint exposed by AOS-CX, the network operating system running on HPE Aruba Networking CX-series switches. The endpoint returns data that should be restricted based on the caller's role. A low-privilege authenticated user can invoke the endpoint over the network and receive information reserved for higher-privileged administrators.
Because the scope is changed, the disclosed data affects security-relevant components outside the API itself. Adversaries can use retrieved credentials, topology details, or configuration fragments to pivot toward network services that trust the switch. The confidentiality impact is high, while integrity and availability of the switch remain unchanged.
Root Cause
The root cause is insufficient authorization enforcement on an AOS-CX REST API endpoint. The endpoint authenticates the caller but does not validate that the caller's role permits access to the requested resource. This authorization gap causes sensitive data to be returned to any account with valid credentials, regardless of assigned privilege level.
Attack Vector
Exploitation requires network reachability to the AOS-CX management interface and valid credentials for a low-privilege account, such as an operator or read-only role. The attacker issues an authenticated HTTPS request to the vulnerable API endpoint and parses the response for sensitive fields. No user interaction is required, and exploit complexity is low.
No verified public proof-of-concept code is currently available. See the HPE Support Document for vendor technical details.
Detection Methods for CVE-2026-73775
Indicators of Compromise
- Authenticated REST API requests to AOS-CX endpoints originating from accounts that do not typically use the API
- Elevated volumes of API GET requests from a single low-privilege session, including enumeration patterns
- Unusual response sizes for API calls made by non-administrative users
Detection Strategies
- Enable AOS-CX API access logging and forward the logs to a centralized SIEM for correlation
- Baseline normal API usage per account and role, then alert on deviations such as new endpoints being accessed by operator-level accounts
- Correlate switch API activity with downstream authentication events on services whose credentials are configured on the switch
Monitoring Recommendations
- Monitor RADIUS, TACACS+, and local switch authentication logs for successful low-privilege logins followed by API traffic
- Watch for use of retrieved credentials against adjacent network services such as management platforms, NTP, SNMP, and syslog collectors
- Track configuration reads that expose SNMP community strings, RADIUS shared secrets, or TACACS+ keys
How to Mitigate CVE-2026-73775
Immediate Actions Required
- Apply the fixed AOS-CX firmware version listed in the HPE Support Document as soon as maintenance windows allow
- Audit all AOS-CX local and remote accounts and remove unused low-privilege credentials
- Rotate any shared secrets, SNMP community strings, and service credentials that may have been exposed through the switch configuration
Patch Information
HPE Aruba Networking has published fixed firmware for affected AOS-CX releases. Consult the HPE Support Document for the exact patched versions per platform and upgrade guidance.
Workarounds
- Restrict access to the AOS-CX management interface using management VRF and ACLs so only trusted administrative hosts can reach the REST API
- Disable the REST API on switches where it is not required for operations or automation
- Enforce least-privilege role assignment and remove API access rights from operator-tier accounts until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
