HPE AOS-CX CVE-2026-73754

Exploitation requires an authenticated low-privilege account with SSH (or equivalent CLI) access to the AOS-CX device over the network (AV:N, PR:L). High attack complexity (AC:H) indicates that triggering the DoS is not straightforward - specific command sequences, system state, or timing conditions must be met; these prerequisites are not described in the available data. Impact is strictly an availability disruption (C:N/I:N/A:H); no information disclosure or code execution is possible. Limiting factors include the authentication requirement, the non-default attacker-controlled conditions implied by AC:H, and the absence of any known public exploit.

The CVSS 5.3 medium score reflects a meaningful but bounded risk: AV:N/PR:L means any authenticated CLI user reachable over the network can attempt exploitation, but AC:H constrains the threat to adversaries who can satisfy specific, non-obvious preconditions. Even a mid-sized municipal IT team in leszno managing a campus Aruba deployment should treat this as a secondary priority below the unauthenticated and adjacent-network RCEs in the same advisory, prioritizing patch application as a bundle rather than triaging this CVE in isolation. No EPSS data is provided, KEV status is not confirmed, and no POC is publicly known - all of which further reduce near-term urgency. The primary realistic threat actor is a malicious insider or a compromised low-privilege account, not an external unauthenticated attacker.

An attacker holding a valid low-privilege account on an HPE AOS-CX switch connects via SSH and issues a specially crafted or sequenced set of CLI commands that satisfy the high-complexity preconditions. The affected CLI handler enters an error or resource-exhaustion state, disrupting the switch's normal forwarding, management, or control-plane operations. No public exploit code has been identified at time of analysis, and the AC:H rating implies non-trivial exploit development effort.