ArubaOS-S Switch CVE-2026-76741

Exploitation requires valid authenticated access (PR:L) to the affected management interface of an AOS-S (ArubaOS-Switch) device; it is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The limiting factor is the authentication prerequisite - an attacker must hold working credentials on the switch, so unauthenticated/anonymous exploitation is not supported by the CVSS data. Impact is confined to denial-of-service (A:H only; C:N/I:N), meaning the realistic risk is device crash/disruption rather than compromise. The exact affected software versions and configuration preconditions are not specified in the available input and should be confirmed against HPE advisory hpesbnw05156en_us.

This is a moderate-priority, not a top-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: a network-reachable, low-complexity flaw that requires authentication (PR:L) and yields only availability impact (DoS), with no confidentiality or integrity loss. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The authentication requirement (PR:L) is the key mitigating signal - an attacker must already hold valid credentials on the switch management interface, which substantially narrows the realistic attacker population to insiders or those who have already obtained access. Because impact is limited to denial-of-service (no code execution or data exposure is claimed), this is better characterized as an availability/reliability risk for managed network infrastructure than as a critical breach vector. Prioritize patching on internet- or widely-exposed management planes, but it does not rise to emergency status absent exploitation evidence.

An attacker who already possesses valid low-privileged credentials to an AOS-S switch management interface sends crafted input to the vulnerable interface, triggering a buffer overflow that crashes or hangs the device and disrupts network connectivity. No public exploit code is known, and the attacker gains no code execution or data access - only a denial-of-service outcome. Because authentication is required (PR:L), the scenario most realistically involves a malicious insider or an attacker leveraging previously compromised credentials.