EUVD-2026-93875
GHSA-8cx3-28f8-cvcq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as read-only user
-
ExploitSend crafted AOS-S API request
-
ExecutionEscalate to administrative privileges
-
ImpactGain full switch control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated read-only user account on the AOS-S device and network reachability to the AOS-S management API; the attacker uses that API to escalate to administrative access. The key limiting factor is the prerequisite of valid low-privilege credentials (PR:L) - exploitation is not possible by a fully unauthenticated attacker - making this most relevant where read-only accounts exist, are shared, or can be compromised. No special non-default configuration is called out in the description beyond the API being reachable by the authenticated user. |
| Impact | This is a credible, actionable priority rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a low-complexity, network-reachable attack via the AOS-S API that requires only a low-privileged (read-only) authenticated account, and the full C:H/I:H/A:H impact reflects a complete read-only-to-administrator takeover - a serious trust-boundary break. The limiting factor is PR:L: an attacker must already possess valid read-only credentials, so this is primarily an insider/lateral-movement or stolen-credential risk rather than a purely external unauthenticated threat. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; the signals are consistent (network vector, low privilege, high impact) with no conflicts, but the exploitation-likelihood dimension is simply absent from the data and cannot be inferred. |
| Exploit ScenarioDerived | An attacker who holds or has stolen a low-privilege read-only account (or a malicious internal operator) reaches the AOS-S management API over the network and issues a crafted request that abuses a missing authorization check to perform privileged operations. This elevates the session to administrative access, giving full control over the switch configuration. No public exploit code was identified at time of analysis, and the attack requires valid read-only credentials as a prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authenticated privilege escalation in the HPE Aruba Networking AOS-S management API allows a read-only account to escalate to full administrative access, giving the attacker complete control over confidentiality, integrity, and availability of the affected switch (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable and low-complexity, requiring no user interaction and no non-default configuration beyond the API being reachable, but it is gated by the prerequisite of a valid low-privilege credential (PR:L), so risk concentrates in environments where read-only accounts exist, are shared, or can be compromised; the vendor reports this as a privilege-escalation issue in the AOS-S API. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, yet the combination of a low-bar prerequisite and a total privilege gain makes this a credible, actionable priority rather than an inflated high-CVSS score.
RemediationAI
No vendor-released patch identified at time of analysis, and the supplied data contains no fix version, so the first action is to open HPE Security Bulletin hpesbnw05156en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US), determine whether an updated AOS-S firmware release resolves the API privilege check, and schedule that upgrade during a maintenance window since switch firmware changes trigger a reboot and brief outage. Until fixed firmware is applied, prioritize compensating controls that directly target the PR:L prerequisite: restrict the AOS-S management API to a dedicated management VLAN and to specific trusted source addresses with ACLs or firewall rules, accepting the trade-off that remote monitoring and automation from other segments will break unless those collectors are explicitly allowed; audit and prune read-only accounts, disable any that are unused, generic, or shared, and rotate their credentials and SNMP/API tokens, understanding that removing shared read-only accounts can reduce monitoring coverage and may require re-issuing per-system credentials; and enable logging/alerting on authentication and privilege-change events in the API so that a read-only account performing administrative actions is detected quickly, though this is detective rather than preventive. If read-only access cannot be tightly scoped or audited, consider removing it entirely until a fixed release is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue lives in the management API of AOS-S, the ArubaOS-Switch operating system used across HPE Aruba Networking access and aggregation switches. An account provisioned with read-only rights is intended to view state through that API, but the privilege checks governing administrative operations are insufficient, so the same authenticated session can be used to reach administrative functionality - behavior in the class of improper privilege management / missing authorization enforcement (the input data carries no CWE assignment, so the root-cause class is inferred from the described behavior rather than confirmed). The authoritative CVSS 3.1 vector confirms the mechanics: AV:N means the API is reachable over the network, AC:L means no race conditions or special timing are needed, PR:L confirms a low-privileged authenticated account is required and that a fully unauthenticated attacker cannot exploit it, UI:N means no victim interaction is needed, and S:U with C:H/I:H/A:H reflects that the escalation stays within the same security authority while granting complete compromise of the device. Practically, this is a broken authorization/role-enforcement defect on a network infrastructure control plane, which matters because administrative control of a switch yields configuration changes, credential material, traffic redirection potential, and a foothold for lateral movement toward other switches or the surrounding network.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
API is network-reachable (AV:N) with no described exploitation hurdles (AC:L); a read-only authenticated account is required (PR:L), and escalation to admin yields full C/I/A impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
Executive ViewAI
A privilege-escalation flaw in the HPE Aruba Networking AOS-S management API lets anyone holding a valid read-only credential obtain full administrative control of the affected switch, putting the confidentiality, integrity, and availability of the network segment it serves at risk. Because the flaw is network-reachable, low-complexity, and requires no user interaction, any environment with shared, stale, or service read-only accounts on AOS-S infrastructure carries elevated exposure until the vendor issues remediation. Leadership should treat this as a near-term network-infrastructure risk rather than a theoretical high score, since a single compromised low-privilege login can translate into complete control of the device and the traffic it handles.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management API reachability to a dedicated management VLAN or trusted jump hosts via ACLs and firewall rules; rotate, disable, or eliminate shared and service read-only accounts and enforce unique least-privilege credentials; enable centralized logging and alerting on API authentication, privilege changes, and configuration writes; segment switch management traffic and review read-only role assignments so privileges are granted only where operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB