EUVD-2026-69613
GHSA-q898-2qwx-466h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable AOS-CX service over network
-
DeliverySend crafted malformed packets
-
ExploitTrigger input-parsing memory corruption in daemon
-
ExecutionExecute code with elevated privileges
-
ImpactPivot across switching fabric / manipulate traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the specific AOS-CX daemon that improperly parses malformed input on an affected Aruba CX switch; the attacker must be able to deliver crafted packets to that service. Per CVSS PR:N/UI:N, no authentication and no user interaction are needed, and AC:L indicates no special timing or configuration prerequisites. The chief limiting factor is exposure of the vulnerable service: risk is highest where the daemon is reachable from untrusted or in-band segments and materially lower where switch management/control-plane interfaces are confined to an isolated out-of-band network. The exact daemon, protocol, listening port, and affected version range are not specified in the provided data, so defenders should consult HPE bulletin hpesbnw05134en_us to confirm which interfaces expose the service. |
| Impact | All available signals point to genuine high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and the description independently corroborates unauthenticated remote RCE with elevated privileges. There is no supplied EPSS score, no CISA KEV entry, and no POC reference, so exploitation is not confirmed in the wild and no exploit code is known to be public - the elevated risk here is driven by exploitability characteristics rather than observed activity. The main uncertainty is scope: the affected service/protocol and exact AOS-CX version ranges are not enumerated in the input, so exposure depends on whether the vulnerable daemon listens on management, control-plane, or in-band data interfaces - verify with the HPE advisory. No signals conflict; the CVSS and description agree. |
| Exploit ScenarioDerived | An attacker with network access to a vulnerable switch's affected service sends a sequence of crafted, malformed packets that the daemon mishandles, corrupting memory and yielding code execution at the daemon's elevated privilege level. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), a single reachable packet path is enough to compromise the switch, giving the attacker a foothold to pivot across the network fabric, alter forwarding, or intercept traffic. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
RemediationAI
Apply the fixed AOS-CX firmware identified in HPE security bulletin hpesbnw05134en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US); no exact fixed version is present in the provided data, so pull the precise upgrade target from that advisory rather than relying on an invented version. As compensating controls until switches can be upgraded, restrict reachability of the vulnerable service by placing switch management and control-plane interfaces on an isolated out-of-band management VLAN, applying control-plane ACLs / management-interface access lists to permit only trusted administrative subnets, and blocking the affected daemon's protocol/port at fabric boundaries - with the trade-off that overly broad ACLs can disrupt legitimate management, monitoring (SNMP/NETCONF), or control-plane protocol traffic, so scope them to the specific service once HPE names it. Prioritize internet- or untrusted-segment-exposed switches first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-CX is HPE Aruba Networking's modular, database-driven operating system that powers the Aruba CX line of data-center and campus switches. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx, confirming the switch NOS rather than a general-purpose application. The advisory attributes the issue to 'multiple vulnerabilities' in a single daemon that improperly processes malformed input from network packets - a memory-safety / input-validation defect class (buffer overflow, out-of-bounds access, or similar) typical of packet-parsing services. The upstream CWE is listed as N/A in the input, so the precise root-cause class (e.g., CWE-787/CWE-20) is not confirmed and the daemon and protocol are not publicly named in the provided data.
Know when Aos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated remote code execution with elevated privileges via crafted packets, giving network vector, low complexity, no privileges/interaction, and full C/I/A impact.
Primary rating from Vendor (hpe).
CVSS VectorNVD
DescriptionNVD
Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.
Executive ViewAI
HPE Aruba AOS-CX network operating system on CX switches is vulnerable to unauthenticated remote code execution allowing attackers to gain complete control of network infrastructure with no prior authentication required. No public exploit has been identified at time of analysis, but the critical CVSS 9.8 score and network-facing attack surface make this a top-priority patch for all organizations using Aruba CX switching platforms. With no available patch, this requires immediate containment measures and urgent engagement with HPE for remediation timeline.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict management interface access to authorized administrator IPs via network ACLs; implement network segmentation isolating affected switches from untrusted networks; deploy IDS signatures targeting malformed daemon inputs; establish monitoring for exploitation attempts and baseline normal traffic patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Exploit-DB