EUVD-2026-69623
GHSA-x4q2-qmmg-jcfr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access (same VLAN/L2 segment)
-
DeliveryCraft malformed packet payload
-
ExploitSend packets to AOS-CX switch
-
ExecutionTrigger processing failure in daemon
-
PersistSwitch disrupted or crashes
-
ImpactNetwork connectivity lost
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be on the same network segment (Layer-2 adjacency or equivalent) as the target AOS-CX switch - this is the primary limiting condition imposed by AV:A. No authentication is required (PR:N) and no user interaction is needed (UI:N). The vulnerability appears to affect default configurations with no special feature flag or non-default setting required. Exploitation is limited to availability disruption only (C:N/I:N/A:H); confidentiality and integrity of data are not at risk. Internet-based exploitation is not possible without prior network access to the adjacent segment. |
| Impact | CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly characterizes a medium-severity, adjacency-constrained DoS. The adjacent-network requirement (AV:A) is the primary risk-reduction factor: exploitation demands physical or logical L2 proximity to the switch, ruling out internet-based mass exploitation. No EPSS data or KEV listing is provided, and no public exploit has been identified - reducing urgency relative to the co-bundled RCE vulnerabilities in the same advisory. The real-world priority for this CVE should be lower than CVE-2026-73749 (CVSS 9.8, remote RCE) and CVE-2026-73782 (CVSS 8.8, adjacent RCE) from the same bulletin, though all warrant the same patch cycle. Network operators on untrusted or shared segments (co-location facilities, multi-tenant networks) face elevated risk because the adjacency requirement is easily met. EPSS score is absent from input data; exploitation probability is inferred as low given no KEV listing and adjacent-only vector. |
| Exploit ScenarioDerived | An attacker with access to the same network segment as an HPE Aruba CX switch - such as another host on the same VLAN, a co-tenant in a shared facility, or an insider on the LAN - sends a sequence of specially crafted packets to the switch. The malformed input triggers a processing failure in an AOS-CX daemon, causing the switch to become unresponsive or restart. Network connectivity through the affected switch is disrupted until the device recovers or is rebooted. No exploit code is publicly available; the attack complexity is low once adjacency is achieved. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
RemediationAI
Apply the patch(es) identified in HPE security bulletin HPESBNW05134, available at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US. Exact fixed version numbers are not specified in the available input data - consult the bulletin directly for the minimum patched AOS-CX release. As an interim compensating control, restrict physical and logical access to switch management and data-plane ports from untrusted network segments using upstream ACLs or VLAN isolation. Deploying 802.1X port authentication on access ports limits who can connect to the same Layer-2 segment, reducing the pool of potential attackers. Note that VLAN isolation does not fully eliminate risk if attackers already have a presence in the same segment. Prioritize patching alongside the co-bundled RCE vulnerabilities (CVE-2026-73749, CVE-2026-73782) from the same advisory, which carry higher severity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-CX is HPE Aruba's modern network operating system for the CX-series campus and data-center switches, running on dedicated switch hardware. The affected CPE (cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:*) covers the full AOS-CX product line with no version restriction noted in the input. The CVSS attack vector AV:A (Adjacent) indicates the vulnerability is exploitable from the same network segment or broadcast domain rather than across the internet. No CWE root-cause class was assigned; the description references 'specially crafted packets' triggering a DoS, which is consistent with a malformed-input or resource-exhaustion processing bug in a packet-handling daemon. The same HPE bulletin HPESBNW05134 documents related flaws including format-string RCE (CVE-2026-73782) and daemon-level RCE (CVE-2026-73749), suggesting the advisory covers multiple components of the AOS-CX packet-processing stack.
Know when Aos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent vector confirmed by description; unauthenticated DoS with no confidentiality or integrity impact matches A:H/C:N/I:N.
Primary rating from Vendor (hpe).
CVSS VectorNVD
DescriptionNVD
Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploitation of these vulnerabilities results in disruption of normal operation on affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Exploit-DB