EUVD-2026-69640
GHSA-r9g6-3g57-j9rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AOS-CX API from network
-
DeliveryMeet AC:H exploitation condition
-
ExploitBypass authentication check
-
ExecutionOperate as authenticated admin
-
ImpactModify switch configuration or exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network-level access to the AOS-CX REST API endpoint is required - this is typically the management interface (out-of-band port or in-band management VLAN). The AC:H metric confirms that exploitation requires meeting specific, undisclosed conditions beyond simple network reachability; HPE has not publicly detailed what those conditions are (possible candidates: specific API call sequence, timing dependency, or non-default API configuration). No credentials are required (PR:N). No user interaction is required (UI:N). Limiting factors: the AC:H complexity barrier meaningfully reduces the attacker pool relative to the AC:L sibling CVE-2026-73749; switches whose management API is not exposed externally or is ACL-restricted to trusted hosts have substantially reduced practical exposure. |
| Impact | CVSS 8.1 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H positions this as high severity. The AC:H metric is the critical moderating factor - exploitation is not fire-and-forget; it requires meeting specific conditions not fully detailed in available data, which significantly constrains attacker feasibility compared to the AC:L unauth RCE sibling (CVE-2026-73749). EPSS data is not provided. KEV status is negative, and no public POC has been identified. However, AOS-CX switch management APIs are exposed in enterprise network infrastructure; successful exploitation would give an attacker control equivalent to network admin, enabling configuration changes, traffic interception, or complete switch disruption. The co-disclosure with CVE-2026-73749 (CVSS 9.8 unauth RCE) in the same advisory means defenders should treat this bulletin as a high-priority patch event even if this specific CVE is a secondary concern. Exact exploitation conditions for the AC:H barrier are not disclosed by HPE. |
| Exploit ScenarioDerived | An unauthenticated remote attacker with network access to the AOS-CX management API satisfies specific conditions required by the AC:H barrier - potentially a crafted sequence of API requests, a specific protocol state, or a timing window - to bypass authentication checks. Once bypassed, the attacker operates with the privileges of an authenticated administrator, able to alter switch configuration, exfiltrate network topology and credentials, or disrupt forwarding. No public POC exists at time of analysis, so this scenario remains theoretical but is grounded in the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
RemediationAI
Apply the patched AOS-CX firmware version specified in HPE Security Bulletin HPESBNW05134 (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US). An exact fix version is not independently extractable from the provided data - consult the advisory directly. As a compensating control prior to patching, restrict access to the AOS-CX REST API to trusted management networks using out-of-band management VLANs or ACLs on the management interface. Disabling REST API access entirely eliminates the attack surface but may break automation and monitoring pipelines. Given that HPESBNW05134 also covers CVE-2026-73749 (CVSS 9.8 unauth RCE), patching the entire bulletin should be treated as urgent rather than deferred.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-CX is HPE's modern network operating system for the Aruba CX series campus and data-center switches, featuring a REST API that exposes switch management programmatically. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:* covers all AOS-CX versions with no upper bound, suggesting broad version scope. CWE is listed as N/A - HPE has not published a root-cause class, consistent with the multi-vulnerability bundle pattern in HPESBNW05134. The AC:H CVSS metric indicates that exploitation is not trivially repeatable - likely reflecting a specific protocol state, timing window, race condition, or configuration-dependent attack path required to successfully bypass the authentication mechanism. This is an access-control weakness at the API layer rather than a memory-safety issue.
Know when Aos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible API, no privileges required per description; AC:H retained as HPE signals non-trivial exploitation conditions not publicly specified.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls.
Executive ViewAI
HPE AOS-CX network switches are vulnerable to unauthenticated remote authentication bypass, allowing attackers to gain full administrative access to critical network infrastructure without credentials. This directly compromises network integrity, confidentiality, and availability, enabling unauthorized configuration changes, data interception, and lateral movement. Immediate action is required to restrict administrative access and monitor for exploitation.
Restrict network access to switch management API ports (443/8443) to authorized administrators only via firewall rules and network segmentation. Enable comprehensive audit logging of all authentication attempts and configuration modifications on affected switches. Implement network-based intrusion detection to identify suspicious API access patterns. Establish daily review of switch logs for unauthorized access attempts, anomalous API calls, or unexpected administrative changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Exploit-DB