CVE-2026-73755

Executive Summary

CVE-2026-73755 is a privilege escalation vulnerability residing in the API endpoint of AOS-CX, the network operating system for Aruba (Hewlett Packard Enterprise) switching products. An authenticated low-privilege operator user, after a required social-engineering or UI-driven user action, can access sensitive information from the vulnerable system. The vulnerability carries a CVSS score of 5.7 (Medium) under the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, indicating a high confidentiality impact but no impact on integrity or availability. As of this report, no patch has been identified from any tracked source (patch confidence 0/4), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Affected version ranges have not been disclosed by the CNA.

Technical Analysis

The NVD description provides limited implementation-level detail, but the vulnerability class and attack mechanism can be derived from the available information. The flaw is characterized as a privilege escalation vulnerability in the API endpoint of AOS-CX. AOS-CX is the network operating system used across Aruba CX-series switches, which expose a REST API for programmatic management and configuration.

Attack Surface and Trigger Conditions:

• Authentication requirement: The attacker must hold an authenticated account with the lowest privilege level — that of an "operator" user. In network device RBAC models, operator accounts typically have read-only access to certain operational status data, but should not be able to access configuration data, credentials, or other sensitive system information.
• User action prerequisite (UI:R): The CVSS vector includes UI:R (User Interaction Required), meaning the privilege escalation only succeeds if a legitimate user (e.g., an administrator) performs a specific action. This action likely involves the admin accessing the same API endpoint or performing a standard management operation that inadvertently triggers the privilege escalation path.
• Network accessibility (AV:N): The vulnerable API endpoint is reachable over the network, meaning the attack does not require local console access. In a typical deployment, the AOS-CX management interface (REST API) is exposed on the management network, though it may be segmented from the production data plane.

Vulnerability Mechanism (Class-Level): Without specific function names or endpoint paths disclosed in the NVD description, the mechanism must be described at the class level. The vulnerability is consistent with an improper access control (authorization bypass) flaw in the API layer. Potential mechanisms include:

1. Insufficient authorization checks on a subset of API methods: The API framework may enforce role-based access control (RBAC) on most endpoints, but a specific endpoint or method (e.g., a health check, diagnostic, or status endpoint) may fail to enforce the same authorization checks, allowing any authenticated user (including operator-level) to invoke it.
2. Information disclosure via API response objects: The API may return response payloads containing sensitive data (e.g., configuration blobs, hashed credentials, or SNMP community strings) to lower-privileged roles due to a missing field-level filtering mechanism.
3. Race condition or state-based authorization check: The authorization decision may be made at a point in the API request lifecycle before the privilege context is properly established, a flaw that could be triggered when another user (the "required user action") interacts with the system concurrently.

The confidentiality impact is rated High (C:H), confirming that the information accessible to the low-privilege operator user is significantly sensitive — likely including configuration data, network topology details, or credential material.

Unpatched Status: With patch confidence at 0/4, there is no evidence from any tracked source that the vendor has released a fix, advisory, or workaround. The affected version list is empty, which further complicates remediation planning, as affected deployments cannot be enumerated without vendor input.

Exploitation Scenarios

Because no public PoC exists and the NVD description lacks endpoint-level detail, the attack chain below is inferred from the vulnerability class and must be treated as conditional.

Step 1 — Reconnaissance and Target Identification: An attacker first identifies an AOS-CX switch reachable via its management interface. Shodan-style queries targeting port 443 (HTTPS for the REST API) or the AOS-CX web management interface can be used. The attacker then attempts to authenticate with low-privilege operator credentials, which may be obtained through other means — e.g., default credentials, password spraying against the management interface, or credentials harvested from prior phishing campaigns.

Step 2 — Triggering the Authorization Bypass (Required User Action): The operator user authenticates to the REST API. To exploit the flaw, a second, privileged user must perform an action on the same system. The exact action is unknown from available data, but based on the UI:R requirement, it likely involves an administrator accessing a configuration screen, applying a configuration change, or issuing a diagnostic command through the API or CLI. This action may place the API into a state where the authorization context is not evaluated correctly for subsequent low-privilege requests.

Step 3 — Payload/Execution Method (Class-Level): At the vulnerability-class level, the operator user issues an API request to a sensitive endpoint — e.g., a configuration retrieval or system diagnostics endpoint. Due to the authorization flaw triggered by the admin's prior action, the API processes the operator's request without proper privilege enforcement and returns data that should be restricted to administrators. The payload is thus a crafted HTTP request (e.g., GET or POST to the sensitive API path) authenticated with the operator's session token or API key.

Step 4 — Post-Exploitation Impact: Upon successful exploitation, the operator gains access to sensitive information, which could include:

• Full device configuration (including VLAN maps, ACLs, routing policies).
• Stored credentials or hash values used for RADIUS/TACACS+ integration.
• SNMP community strings.
• Network topology and segment information.

This intelligence can be leveraged for lateral movement into the broader network, credential reuse against other infrastructure, or targeted attacks against sensitive network segments.

Explicit Caveat: No public PoC is available, and the attack chain is inferred from the vulnerability class and CVSS vector. Specific endpoint paths and exact trigger actions are unknown.

Impact Assessment

CVSS Breakdown (derived from the vector):

• Attack Vector: Network (AV:N) — Remote exploitation is possible; no physical or adjacent access required.
• Attack Complexity: Low (AC:L) — No special conditions beyond the user action must be met; the attack can be reliably reproduced.
• Privileges Required: Low (PR:L) — An authenticated operator account is required; this is a realistic compromise level for internal threats or post-breach escalation.
• User Interaction: Required (UI:R) — A separate, privileged user must perform an action on the system.
• Confidentiality Impact: High (C:H) — The exposed information is sensitive, likely including configuration data and credentials.
• Integrity/Availability Impact: None (I:N, A:N) — The flaw allows data exposure only; it cannot be used to modify configuration or disrupt service.

Business Impact: For enterprises using Aruba CX-series switches, this vulnerability represents a significant information-disclosure risk from the network infrastructure layer. Network device configurations frequently contain sensitive data (e.g., SNMP community strings, RADIUS secrets, IPsec keys) that, if disclosed, could enable further compromise of the network. The low privileges required mean that even a compromised operator account — typically considered low-risk — can be leveraged for high-impact data theft.

Blast Radius: The blast radius is limited to a single AOS-CX device per exploitation event, but because network switches often share similar configurations, disclosed information from one device may be valid across multiple devices in the fleet, amplifying the practical impact. The data compromise could also expose VLAN segregation details, enabling lateral movement between network segments.

Detection Guidance

The following detection rules target the exploitation mechanism: an authenticated low-privilege operator account accessing sensitive API endpoints or receiving unusually large/detailed responses. These rules are heuristic and may require tuning to the specific AOS-CX API implementation.

Sigma Rule

title: AOS-CX API Privilege Escalation - Operator Accessing Sensitive Endpoints
id: 7c9a51f2-3f4d-4a0b-9c2a-7d3e5b6a8c21
status: experimental
description: Detects API requests from low-privilege operator users to sensitive AOS-CX endpoints, indicative of CVE-2026-73755 exploitation attempts.
author: Valtersit Threat Intelligence
date: 2026/06/01
tags:
    - attack.t1068
    - attack.credential_access
    - attack.collection
logsource:
    product: aruba
    service: aos-cx-api
detection:
    selection_auth:
        user_role: "operator"
    selection_sensitive:
        api_endpoint|contains:
            - "config"
            - "system"
            - "diag"
            - "snmp"
    selection_http:
        http_method:
            - "GET"
            - "POST"
    condition: selection_auth and selection_sensitive and selection_http
falsepositives:
    - Legitimate read-only operational monitoring by operator accounts on allowed endpoints
level: high

YARA Rule

rule AOS_CX_PrivEsc_CVE_2026_73755 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects API response payloads or logs containing evidence of AOS-CX privilege escalation attempts (CVE-2026-73755)"
        cve = "CVE-2026-73755"
        date = "2026-06-01"
    strings:
        $a1 = "operator" ascii wide nocase
        $a2 = "privilegeLevel" ascii wide nocase
        $b1 = "configuration" ascii wide nocase
        $b2 = "running-config" ascii wide nocase
        $c1 = "HTTP/1.1 200" ascii wide
        $c2 = "authorization" ascii wide nocase
        $d1 = "AOS-CX" ascii wide
    condition:
        uint16(0) == 0x0A0D or  // PCAP data
        uint32(0) == 0x504B0304  // ZIP/Log archive
        and 2 of ($a*)
        and 1 of ($b*)
        and 1 of ($c*)
        and $d1
}

Suricata IDS Rule

alert http any any -> any any (msg:"AOS-CX Privilege Escalation - Operator Accessing Sensitive API (CVE-2026-73755)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/"; nocase; http.uri; content:"config"; nocase; http.uri; content:"system"; nocase; http.header; content:"Authorization"; http.header; content:"operator"; nocase; classtype:attempted-user; sid:202673755; rev:1;)

Note: This rule assumes the AOS-CX REST API uses /rest/v1/ style paths and passes operator role context in the Authorization header. Adjust URI patterns to match your environment's observed API paths.

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where event.action == "authentication_success" and
     user.name != null and user.name : "operator*"]
  [http where event.outcome == "success" and
     http.request.method : ("GET", "POST") and
     url.path : ("/rest/*config*", "/rest/*system*", "/rest/*diag*") and
     user.name : "operator*"]

Splunk SPL Query

index=network sourcetype=aoscx:api
| where status=200
| search user_role="operator"
| rex field=api_endpoint "(?<category>/config/|/system/|/diag/)"
| where isnotnull(category)
| stats count by src_ip, user, api_endpoint, _time
| sort _time

Wazuh OSSEC Rule

<group name="aoscx,privilege_escalation,CVE-2026-73755,">
    <rule id="100375" level="12">
        <decoded_as>json</decoded_as>
        <field name="user_role">operator</field>
        <regex>api_endpoint\.(config|system|diag)</regex>
        <description>AOS-CX API: operator user accessed sensitive endpoint (CVE-2026-73755)</description>
        <mitre>
            <id>T1068</id>
        </mitre>
        <group>credential_access,collection,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, fix, or workaround has been identified from any tracked source.

1) Immediate Mitigations (No Patch Available)

• Restrict API access at the network layer: Firewall rules should limit access to the AOS-CX REST API (typically TCP/443 or TCP/8080) to only trusted management hosts and administrative VLANs. Do not expose the API to the general user network or the internet.
• Enforce strict RBAC on operator accounts: Review all operator-level accounts. Where possible, disable operator accounts or reduce their permissions to the absolute minimum required for operational monitoring. Consider removing operator accounts entirely if they are not required for day-to-day operations.
• Enable and monitor API audit logging: If the AOS-CX logging framework supports API audit trails, enable verbose logging for all API interactions, specifically capturing the authenticated user role and endpoint accessed. Alert on operator-role access to configuration-related endpoints.
• Require multi-factor authentication (MFA): If supported by the AOS-CX authentication integration (e.g., RADIUS/TACACS+ with Duo or other MFA proxies), enforce MFA for all management access to reduce the likelihood of operator credential compromise.
• Segment the management plane: Isolate the management network from the data plane networking. Ensure that API access is only possible from dedicated jump hosts with additional monitoring.

2) Patch/Upgrade Steps

• Monitor the Aruba/HPE security advisory page and the CVE reference below for vendor communication. No fix is available as of this report's date.
• When a patched AOS-CX firmware version is released, establish a change window and upgrade all affected CX-series switches following the vendor's upgrade guidance. Validate the upgrade in a lab environment first, paying attention to any configuration migration steps.
• After patching, verify that the API authorization checks are functioning as expected by having an operator account attempt to access a sensitive endpoint and confirming access is denied.

3) Long-Term Hardening

• Credential hygiene: Enforce strong password policies and rotation for all device management accounts. Audit for default credentials on all network devices.
• Configuration backup encryption: Encrypt any stored configuration backups (e.g., on TFTP/SFTP servers) so that even if a configuration file is exfiltrated, it is protected at rest.
• Network segmentation review: Periodically audit VLANs and ACLs. If sensitive configuration data (SNMP community strings, RADIUS keys) is learned by an attacker, verify that this data cannot be reused to access other segments.
• Vulnerability management process: Add this CVE to your vulnerability tracking system. Re-evaluate the risk posture when the vendor releases the affected version list and patch — the attack surface may be broader than currently known.

References

1. NVD Entry for CVE-2026-73755: https://nvd.nist.gov/vuln/detail/CVE-2026-73755
2. Aruba (HPE) Security Advisory Portal: https://www.arubanetworks.com/support-services/security-bulletins/ — Monitor for pending advisory; unreleased as of this report.
3. FIRST.org EPSS (Not yet scored): https://www.first.org/epss/ — Check periodically for the EPSS score to prioritize this vulnerability once scored.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Currently does not include this CVE. Recheck regularly.
5. MITRE ATT&CK — T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/

Threat Actor Activity: No exploitation-in-the-wild evidence or known threat actor campaigns reference this CVE. The lack of public PoC and vendor patch suggests the vulnerability may have been recently disclosed (possibly time-of-disclosure) and could be targeted by advanced actors prior to remediation availability.