CVE-2026-73781: AOS-CX Stored XSS Vulnerability

CVE-2026-73781 Overview

CVE-2026-73781 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Aruba Networking AOS-CX. An authenticated remote attacker with high privileges can inject persistent script payloads that execute in the browser of an administrative user viewing the affected interface. Successful exploitation allows arbitrary script execution within the trust context of the management UI, enabling session theft, configuration changes, and pivoting deeper into managed network infrastructure. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in an administrator's session, leading to full compromise of the AOS-CX management plane and any downstream network devices it controls.

Affected Products

HPE Aruba Networking AOS-CX (web-based management interface)
Refer to the HPE Security Bulletin for the complete list of affected versions
AOS-CX-managed switches exposing the web UI to administrative users

Discovery Timeline

2026-09-01 - CVE-2026-73781 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73781

Vulnerability Analysis

The vulnerability resides in the AOS-CX web management interface, which fails to properly neutralize user-supplied input before storing it and rendering it back to other users. An attacker with authenticated access at a high privilege level can submit crafted input through a field accepted by the interface. The malicious payload is persisted on the device and later served to an administrator viewing the affected page.

When the administrator's browser renders the poisoned content, the injected script executes with the origin of the management interface. Because the scope metric is Changed, the impact extends beyond the vulnerable component into the administrator's browser session and any resources it can reach. User interaction is required, meaning the administrator must load the poisoned view for the payload to fire.

Root Cause

The root cause is improper output encoding of stored data rendered by the AOS-CX web UI. Input accepted through authenticated administrative endpoints is not sanitized against HTML and JavaScript contexts before being written to the datastore, and it is not escaped when later inserted into responses returned to users.

Attack Vector

Exploitation requires the attacker to hold valid credentials with sufficient privileges to submit data that is stored by the management interface. The attacker submits a payload containing HTML or JavaScript, and waits for an administrative user to visit the affected view. Once triggered, the script can exfiltrate session cookies, issue arbitrary API calls under the admin's identity, alter switch configuration, or pivot to other systems reachable from the admin browser.

No verified public proof-of-concept code is available for this vulnerability. Consult the HPE Security Bulletin for vendor-provided technical details.

Detection Methods for CVE-2026-73781

Indicators of Compromise

Unexpected HTML tags, <script> fragments, or JavaScript event handlers stored in AOS-CX configuration fields, descriptions, hostnames, or user-provided labels
Administrative sessions issuing API calls or configuration changes from unusual client-side flows shortly after loading management UI pages
Outbound requests from administrator workstations to unfamiliar domains immediately after accessing the AOS-CX web interface
Anomalous configuration changes on AOS-CX switches with no corresponding change-management ticket

Detection Strategies

Inspect stored configuration objects and log fields for characters and sequences associated with HTML or script injection, including <, >, onerror=, javascript:, and encoded variants
Review web server and audit logs on AOS-CX devices for input submissions containing markup, especially from accounts that should not perform such operations
Correlate administrator UI access events with subsequent privileged API activity to identify script-driven actions

Monitoring Recommendations

Enable and forward AOS-CX audit logs and authentication events to a centralized log platform for correlation
Alert on new or modified administrator accounts, changes to AAA configuration, and unexpected certificate or SNMP configuration edits
Monitor administrator workstation browsers for outbound connections to non-corporate destinations following management interface use

How to Mitigate CVE-2026-73781

Immediate Actions Required

Apply the fixed AOS-CX firmware version identified in the HPE Security Bulletin as soon as maintenance windows allow
Restrict the AOS-CX web management interface to a dedicated management VLAN or jump host and block access from general user networks
Audit administrative accounts and remove any privileged accounts that are no longer required to reduce the pool of potential attackers meeting the high-privilege prerequisite
Review stored configuration fields for suspicious content and clear any entries containing script or markup

Patch Information

HPE has published fixed software versions in security bulletin hpesbnw05134en_us. Administrators should consult the HPE Security Bulletin for the specific AOS-CX branches and build numbers that resolve CVE-2026-73781, and follow the vendor's recommended upgrade path.

Workarounds

Disable the web-based management interface where CLI, NETCONF, or REST API management is sufficient for operations
Enforce strong role-based access control and reserve write privileges to a minimal set of trusted administrators
Require administrators to access the AOS-CX web UI only from hardened jump hosts with browser isolation or script-blocking extensions
Enable multi-factor authentication on all administrative accounts to raise the cost of credential compromise

bash

# Example: restrict AOS-CX management access to a dedicated subnet
switch(config)# ssh server vrf mgmt
switch(config)# https-server vrf mgmt
switch(config)# access-list ip MGMT_ACL
switch(config-acl-ip)# 10 permit tcp 10.10.10.0/24 any eq 443
switch(config-acl-ip)# 20 deny tcp any any eq 443
switch(config)# interface mgmt
switch(config-if-mgmt)# apply access-list ip MGMT_ACL in