CVE-2026-73782: AOS-CX CLI Format String RCE Vulnerability

CVE-2026-73782 Overview

CVE-2026-73782 is a format string vulnerability [CWE-134] in the command line interface of HPE Aruba Networking AOS-CX. An unauthenticated attacker with adjacent network access can exploit this flaw to execute arbitrary code as a privileged user on the underlying operating system. The vulnerability affects switches running AOS-CX and could allow full compromise of network infrastructure devices.

Critical Impact
Successful exploitation grants unauthenticated attackers arbitrary code execution as a privileged user on the underlying operating system of affected AOS-CX switches.

Affected Products

HPE Aruba Networking AOS-CX
AOS-CX command line interface component
HPE Aruba switches running vulnerable AOS-CX firmware

Discovery Timeline

2026-09-01 - CVE-2026-73782 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73782

Vulnerability Analysis

The vulnerability is a format string flaw [CWE-134] within the AOS-CX command line interface. Format string vulnerabilities arise when user-controlled input reaches a formatting function without proper sanitization. The vulnerable function interprets attacker-supplied format specifiers as legitimate control tokens.

Attackers can leverage format specifiers such as %s, %x, or %n to read process memory or write to arbitrary addresses. In AOS-CX, this behavior extends to arbitrary code execution as a privileged user on the switch's operating system. The attacker does not need valid credentials to reach the vulnerable code path.

Root Cause

The root cause is improper handling of externally influenced input used as a format string within the CLI. The CLI passes attacker-controlled data directly to a formatted output function rather than treating it as a literal argument. This design flaw allows format specifiers embedded in user input to be interpreted at runtime.

Attack Vector

Exploitation requires adjacent network access to the target switch. An attacker positioned on the same logical or physical network segment can reach the CLI listener without authentication. The attack complexity is low, and no user interaction is required. Successful exploitation yields full confidentiality, integrity, and availability impact on the underlying operating system.

No verified proof-of-concept code is publicly available for CVE-2026-73782. See the HPE Support Document for vendor technical details.

Detection Methods for CVE-2026-73782

Indicators of Compromise

Unexpected CLI process crashes or restarts on AOS-CX switches, which may indicate failed format string exploitation attempts.
CLI input strings containing sequences of format specifiers such as %s, %x, %p, or %n in logs.
New or unexpected privileged processes running on the switch operating system after CLI sessions from untrusted sources.

Detection Strategies

Review AOS-CX audit and CLI logs for malformed command input containing repeated format specifier tokens.
Monitor management VLAN traffic for unauthenticated CLI connections originating from unexpected hosts or segments.
Alert on anomalous outbound connections initiated from AOS-CX switches, which can indicate post-exploitation activity.

Monitoring Recommendations

Forward AOS-CX syslog and audit events to a centralized SIEM for correlation across the switching fabric.
Baseline normal administrative access patterns for switches and alert on deviations in source, timing, or command volume.
Track firmware versions across the AOS-CX estate to identify unpatched devices exposed to adjacent-network attackers.

How to Mitigate CVE-2026-73782

Immediate Actions Required

Apply the AOS-CX firmware updates referenced in the HPE Aruba Networking security bulletin as soon as maintenance windows permit.
Restrict management plane access to trusted administrative subnets using ACLs and dedicated out-of-band management VLANs.
Audit and disable unused CLI access methods on affected switches, particularly on interfaces reachable from user segments.

Patch Information

HPE Aruba Networking has published fixed firmware versions and remediation guidance in the HPE Support Document. Administrators should consult the advisory to identify the specific AOS-CX branches and builds that resolve CVE-2026-73782 and plan upgrades accordingly.

Workarounds

Segment the switch management interface onto an isolated out-of-band network unreachable from user or guest VLANs.
Enforce strict ACLs limiting CLI access to a small set of hardened administrative workstations.
Disable unnecessary management services on the switch until patched firmware is deployed.

bash

# Example: restrict AOS-CX management access to a trusted subnet
access-list ip MGMT_ACL
    10 permit tcp 10.0.10.0/24 any eq ssh
    20 deny  tcp any any eq ssh
    30 permit any any any

interface mgmt
    ip access-group MGMT_ACL in