HPE AOS-CX CVE-2026-73780

Exploitation requires two simultaneous conditions: an authenticated administrator must hold an active session in the AOS-CX web management interface, and that administrator must be convinced to visit and interact with a specially crafted attacker-controlled URL - typically delivered via phishing, watering-hole, or malicious advertisement. The vulnerability applies only to "some sessions" within the interface, not universally across all management endpoints, meaning not all administrative actions are equally exposed. The switch's web management interface must be reachable from the same network context as the attacker's payload delivery mechanism (i.e., the victim's browser must be able to reach the switch UI while also loading the malicious page). Exploitation cannot succeed against administrators using CLI-only (SSH) management or those whose web interface is isolated behind strict network controls that prevent cross-origin browser requests from reaching it.

The CVSS 8.3 score is elevated by S:C scope change and full C:H/I:H/A:H impact, which accurately reflects the severity of arbitrary switch configuration compromise - an attacker who successfully forges requests could manipulate VLANs, disable port security, add rogue admin accounts, or disrupt network availability. However, AC:H and UI:R are genuine constraints: exploitation requires an authenticated network administrator to concurrently hold an active AOS-CX web session and interact with attacker-supplied content, a condition requiring coordinated social engineering rather than opportunistic scanning. No EPSS data, KEV listing, or public exploit code is available, placing this in the category of a credible but not immediately weaponized threat. The partial nature of the CSRF gap - affecting only "some sessions" - complicates both exploitation and defensive triage, since the specific unprotected endpoints are not publicly enumerated. In the context of the broader HPESBNW05134 advisory that also includes a CVSS 9.8 unauthenticated RCE (CVE-2026-73749), this CSRF vulnerability is comparatively lower priority but should be addressed in the same patching cycle.

An attacker targeting a corporate network identifies that administrators manage HPE AOS-CX switches via the web interface. The attacker sends a phishing email to a network engineer containing a link to an attacker-controlled page; when the engineer clicks the link while authenticated to the switch web UI in another browser tab, the malicious page silently issues forged POST requests to the management interface - such as adding a rogue administrative account or modifying ACL rules - with the engineer's session cookies automatically attached by the browser. No public POC exploit has been identified at time of analysis.