Aruba AOS-S CVE-2026-76743

Exploitation targets the AOS-S (HPE Aruba Networking switch) management interface and requires network reachability to that interface. Per the vendor, success additionally depends on 'certain preconditions outside of the attacker's control' being present - the advisory does not specify these, but their existence is the primary limiting factor and means exploitation is not reliable against an arbitrary default deployment. Defenders can meaningfully reduce exposure by restricting management-plane access to trusted administrative networks/VLANs rather than exposing it broadly. The exact configuration, protocol, or state that constitutes the required precondition should be confirmed from HPE advisory hpesbnw05156en_us.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8 CRITICAL) nominally describes a trivially exploitable, network-reachable, unauthenticated authentication bypass in the AOS-S management interface. However, this score is in direct tension with the vendor description, which states exploitation is only possible 'if certain preconditions outside of the attacker's control are met' - language that contradicts the AC:L (low attack complexity) metric and argues for AC:H, since success depends on conditions the attacker cannot manufacture. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuinely serious flaw class (unauthenticated auth bypass on network infrastructure management planes), but the precondition caveat likely makes real-world exploitation more conditional than the 9.8 implies - treat as a high-priority patch for exposed management interfaces while recognizing the headline score overstates the ease of weaponization until the preconditions are clarified by HPE.

An attacker with network reachability to an AOS-S switch's management interface sends requests that leverage the authentication-bypass flaw to obtain unauthorized administrative access to the device, provided the vendor-noted preconditions happen to be present in that deployment. No public proof-of-concept is available, and successful exploitation is gated by conditions outside the attacker's direct control, so opportunistic mass exploitation is unlikely absent those conditions.