HPE AOS-CX CVE-2026-73776

Exploitation requires: (1) an authenticated AOS-CX CLI session with administrative (high) privileges - PR:H in the CVSS vector confirms this requirement; (2) local access to the CLI, meaning physical console or an established SSH management session (AV:L - not directly network-reachable); and (3) 'certain pre-conditions outside of the attacker's control,' an unspecified system state or configuration that must be present for the signature bypass to succeed. The third condition means even a legitimate administrator with full CLI access cannot reliably trigger exploitation on demand. Network-based remote exploitation is not possible without first establishing an authenticated admin session. These combined prerequisites - admin credentials, local vector, and uncontrolled environmental pre-conditions - make automated or opportunistic mass exploitation implausible.

At CVSS 7.9 (High), this vulnerability carries a meaningful score but is substantially constrained in practice. The local attack vector (AV:L) definitively rules out direct network-based exploitation - an attacker must first establish authenticated CLI access with administrative privileges (PR:H), requiring insider access, credential compromise, or physical console presence. HPE's explicit mention of 'pre-conditions outside the attacker's control' introduces a further unpredictability factor: even a privileged insider cannot reliably trigger exploitation on demand, as the triggering conditions are environmental and uncontrolled. The scope change to C:H/I:H on the underlying OS is the most consequential aspect, enabling persistent compromise of switch hardware beneath the management plane with potential impact on network infrastructure integrity. No CISA KEV listing is present, no public exploit exists, and EPSS data is not available. The realistic threat model is a malicious insider or a threat actor who has already compromised admin credentials - not an external opportunistic attacker. Organizations should treat this as a privileged-access-management and insider-threat concern, prioritizing admin account hygiene and CLI session monitoring over emergency patching timelines.

An insider or attacker who has compromised a network administrator's credentials connects to the AOS-CX CLI via SSH and waits for or identifies an environmental triggering condition (the specifics of which HPE has not publicly disclosed). Once conditions are met, the attacker submits a crafted payload through the CLI that bypasses signature verification, resulting in arbitrary code execution on the underlying switch OS and potential persistent compromise of the network device below the management plane. No public exploit code exists to facilitate this scenario at time of analysis.