CVE-2026-73780 Overview
CVE-2026-73780 is a Cross-Site Request Forgery (CSRF) vulnerability in the web-based management interface of HPE Aruba AOS-CX switches. Certain sessions in the interface lack CSRF protection tokens. A remote unauthenticated attacker can exploit this weakness by convincing an authenticated administrator to visit a specially crafted URL. Successful exploitation allows the attacker to execute arbitrary input against the management interface using the victim's authenticated session. The flaw is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
An attacker can hijack an authenticated administrator session to issue arbitrary configuration commands against AOS-CX switches, potentially compromising network confidentiality, integrity, and availability.
Affected Products
- HPE Aruba Networking AOS-CX switches (web-based management interface)
- Refer to the HPE Security Advisory for the specific affected firmware versions
- Devices with the AOS-CX web UI enabled and administrators actively logged in
Discovery Timeline
- 2026-09-01 - CVE-2026-73780 published to NVD
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-73780
Vulnerability Analysis
The AOS-CX web management interface fails to enforce anti-CSRF tokens on some authenticated session endpoints. Without these tokens, the server cannot distinguish legitimate requests submitted through the interface from forged requests initiated by an attacker-controlled site. When an authenticated administrator loads attacker content in the same browser, the browser automatically attaches session cookies to the crafted request. The switch processes the request as if the administrator had issued it directly.
Exploitation requires user interaction and specific browser conditions, which raises attack complexity. However, the scope is changed because a successful attack executed by a low-privileged web user can impact the switch control plane and downstream network resources.
Root Cause
The root cause is missing or improperly validated CSRF protection on privileged operations exposed through the AOS-CX web UI. Session state relies solely on cookie-based authentication without an unpredictable per-request token bound to the user session. This omission is a classic CWE-352 design gap.
Attack Vector
The attack vector is network based and user-interaction dependent. An attacker hosts a page containing a hidden form, image, or script that submits requests to the AOS-CX management interface. The attacker then lures an authenticated switch administrator to the page through phishing, a watering-hole page, or a malicious advertisement. Once loaded, the victim's browser transmits the forged request with valid session cookies, and the switch executes the attacker-supplied input.
No authenticated code example is published for this issue. See the HPE Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-73780
Indicators of Compromise
- Unexpected configuration changes on AOS-CX switches shortly after an administrator browsed external sites
- Web management interface requests originating with Referer or Origin headers pointing to untrusted domains
- Administrative actions logged from IP addresses matching known admin workstations but timed with external web activity
- New user accounts, altered ACLs, or modified VLAN configurations without a matching change ticket
Detection Strategies
- Correlate switch configuration change events with proxy or DNS logs to identify administrator visits to untrusted URLs near the time of change
- Alert on AOS-CX web UI POST requests carrying Referer headers external to the management network
- Baseline normal administrator behavior on the management interface and flag deviations in request timing, sequence, or endpoint usage
Monitoring Recommendations
- Forward AOS-CX syslog, AAA, and audit logs to a centralized analytics platform for correlation with web proxy telemetry
- Monitor administrator workstations for browser activity that overlaps with active AOS-CX management sessions
- Track outbound HTTP requests from admin subnets to newly registered or low-reputation domains
How to Mitigate CVE-2026-73780
Immediate Actions Required
- Apply the firmware update referenced in the HPE Security Advisory to all affected AOS-CX switches
- Restrict access to the AOS-CX web management interface to a dedicated out-of-band management network
- Require administrators to log out of the switch web UI immediately after each session and to use isolated browsers or workstations for management
- Enforce phishing-resistant authentication and web filtering on administrator workstations
Patch Information
HPE has released fixed firmware for affected AOS-CX versions. Consult the HPE Security Advisory hpesbnw05134en_us for the specific fixed versions applicable to each switch model and upgrade path.
Workarounds
- Disable the web-based management interface and use SSH or the API with explicit anti-CSRF controls until patching is complete
- Place management interfaces behind a jump host that terminates admin sessions on logout and blocks arbitrary outbound web traffic
- Configure firewall rules that permit management traffic only from approved administrator subnets
- Instruct administrators to avoid browsing untrusted content in the same browser session used for switch management
# Example: disable HTTPS server on AOS-CX until patch is applied
switch# configure terminal
switch(config)# no https-server vrf mgmt
switch(config)# no https-server vrf default
switch(config)# end
switch# write memory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
