CVE-2026-73777: AOS-CX Switches Authentication Bypass Flaw

CVE-2026-73777 Overview

CVE-2026-73777 is an authentication bypass vulnerability in the API endpoint of HPE Aruba Networking AOS-CX switches. An unauthenticated remote actor can circumvent existing authentication controls over the network. The weakness is classified under [CWE-287: Improper Authentication].

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability on affected switches. Because AOS-CX devices sit at the core of enterprise data center and campus fabrics, unauthorized access to their management API can expose routing configuration, VLAN topology, and administrative credentials.

Critical Impact
Unauthenticated remote attackers can bypass authentication on AOS-CX switch APIs and gain access to management functionality typically restricted to administrators.

Affected Products

HPE Aruba Networking AOS-CX switches (see HPE Security Bulletin for specific models and versions)
AOS-CX switch API endpoint
Network management interfaces exposed on affected AOS-CX firmware

Discovery Timeline

2026-09-01 - CVE-2026-73777 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73777

Vulnerability Analysis

The vulnerability resides in the REST API endpoint exposed by AOS-CX switches. The API fails to enforce authentication controls under specific request conditions. A remote actor can send crafted requests that reach protected functionality without providing valid credentials.

The attack complexity is high, indicating that exploitation requires specific conditions such as timing, configuration state, or crafted request sequences rather than a trivial credential omission. No user interaction and no prior privileges are required. Successful exploitation grants access to administrative API functions with impact on all three security properties.

Root Cause

The root cause is improper authentication logic [CWE-287] in the AOS-CX API request handling path. Authentication checks do not consistently validate the identity of the requester before granting access to protected resources. HPE has not publicly disclosed the specific flawed code path.

Attack Vector

Exploitation occurs over the network against the switch management API. An attacker with network reachability to the API endpoint issues crafted HTTP or HTTPS requests that bypass the authentication layer. Once authentication is circumvented, the actor can interact with API functions to read configuration, modify device state, or disrupt switch operation.

No verified public exploit code is available at this time. Refer to the HPE Security Bulletin for vendor-specific technical detail.

Detection Methods for CVE-2026-73777

Indicators of Compromise

Unexpected HTTP or HTTPS requests to AOS-CX REST API paths from untrusted source addresses.
API responses returning HTTP 200 status codes for sessions that lack a preceding successful login event.
Configuration changes, user account modifications, or firmware operations on the switch that do not correlate with authorized administrator activity.
New or altered SNMP, AAA, or TACACS+ settings appearing without a corresponding change management record.

Detection Strategies

Monitor AOS-CX audit logs for API access events that lack an associated authenticated session identifier.
Correlate switch management plane traffic with the authorized administrator source subnet allow-list and alert on deviations.
Baseline normal API call volume and alert on request rate anomalies against management interfaces.

Monitoring Recommendations

Forward AOS-CX syslog and audit events to a centralized SIEM for retention and correlation.
Enable packet capture or NetFlow on the out-of-band management network segment serving switches.
Track configuration diffs on managed switches using a network configuration management tool and alert on out-of-window changes.

How to Mitigate CVE-2026-73777

Immediate Actions Required

Restrict network reachability to AOS-CX management APIs using access control lists that permit only trusted administrator subnets and jump hosts.
Move switch management interfaces onto a dedicated out-of-band network isolated from user and server VLANs.
Audit AOS-CX devices for unauthorized configuration changes, new local accounts, and modified AAA settings.
Apply the vendor patch as soon as it is available for your affected AOS-CX version.

Patch Information

HPE has published a security bulletin covering this vulnerability. Consult the HPE Security Bulletin for the list of fixed AOS-CX firmware versions and upgrade guidance specific to your switch model.

Workarounds

Disable the REST API on AOS-CX switches where it is not required for operations or automation.
Enforce management access restrictions using https-server and rest access-group configuration to permit only known administrative source addresses.
Require VPN or bastion host access before allowing any connection to switch management interfaces.
Rotate administrative credentials, API tokens, and shared secrets on any switch suspected of exposure.

bash

# Example AOS-CX configuration restricting REST API access
# Consult vendor documentation for the exact syntax for your firmware version
configure terminal
  https-server rest access-mode read-write
  https-server vrf mgmt
  access-list ip MGMT_ALLOW
    10 permit tcp 10.0.0.0/24 any eq 443
    20 deny  tcp any any eq 443
  interface mgmt
    apply access-list ip MGMT_ALLOW in
end
write memory