CVE-2026-73765

Executive Summary

CVE-2026-73765 is an authenticated path traversal vulnerability affecting API endpoints in AOS-CX, the operating system powering Aruba Networks (HPE) switching platforms. Successful exploitation enables an authenticated attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution with elevated privileges. The vulnerability carries a CVSS score of 7.2 (High), with no known public exploit, no CISA KEV listing, and no vendor patch currently available, making affected devices critically exposed to insider threats or compromised administrative accounts.

Technical Analysis

Vulnerability Class

CVE-2026-73765 falls into the path traversal vulnerability class (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The flaw resides within API endpoints exposed by the AOS-CX operating system. The NVD description specifies that the vulnerability permits file writes, distinguishing it from the more common read-only traversal variants.

Attack Mechanism

The attack mechanism operates as follows:

1. Authentication Requirement: The vulnerability requires prior authentication. This is reflected in the CVSS vector's PR:H (High Privileges Required) component, indicating the attacker must possess administrative or highly privileged credentials to access the vulnerable API endpoints.

2. Path Traversal in API Endpoints: The vulnerable API endpoints fail to properly sanitize or validate user-supplied path parameters. An attacker can inject path traversal sequences (e.g., ../, ..%2F, or absolute path references) into file-related API operations.

3. Arbitrary File Write: Successful traversal allows the attacker to write files to arbitrary locations on the underlying Linux-based operating system of the AOS-CX device. This bypasses the intended application-level directory isolation.

4. Remote Code Execution Escalation: By writing crafted files to strategic operating system locations (e.g., cron directories, systemd unit files, web root directories, or configuration directories), the attacker can achieve remote code execution with the privileges of the AOS-CX management process, typically root or a privileged service account.

Attack Surface

The attack surface includes:

• Management API endpoints: RESTful or CLI-based APIs exposed for network management.
• Configuration upload/download functions: Any API that handles file uploads, backups, or firmware operations.
• Web-based management interfaces: If the API endpoints are proxied through the web management interface.

Technical Speculation Constraints

The NVD description provides insufficient granularity to identify specific endpoint names, parameter structures, or affected versions. The attack surface enumeration above is derived from the vulnerability class description and CVSS scoring rather than confirmed implementation details.

Exploitation Scenarios

Scenario 1: Malicious Administrator Account

Attack Chain:

1. Reconnaissance: An attacker with valid administrative credentials (obtained via phishing, credential stuffing, or insider access) identifies the target AOS-CX device via network scanning (e.g., Shodan query for product:"ArubaOS-CX").
2. Trigger: The attacker authenticates to the management API and identifies a file-write operation endpoint accepting user-controlled path parameters.
3. Payload: The attacker submits a crafted API request incorporating traversal sequences (e.g., ../../../../etc/cron.d/malicious) to write a rogue cron job containing a reverse shell or arbitrary command payload.
4. Post-Exploitation: The cron job executes the payload with elevated privileges. The attacker establishes persistent remote access, potentially pivoting into the network management plane to compromise additional infrastructure.

Scenario 2: Compromised Service Account

Attack Chain:

1. Reconnaissance: An attacker compromises a service account (e.g., via an adjacent unrelated vulnerability or exposed API key) that has API access to the AOS-CX device.
2. Trigger: The attacker enumerates the API endpoints to identify file-write capabilities that accept path parameters.
3. Payload: The attacker writes a malicious script to a startup directory (e.g., /etc/init.d/ or a systemd unit directory) that executes arbitrary commands upon system reboot or service restart.
4. Post-Exploitation: Upon reboot or reload, the malicious script executes with root privileges, providing the attacker with persistent high-integrity access to the device.

Inference Note

No public PoC or exploit code exists for CVE-2026-73765. The above scenarios are inferred from the vulnerability class (authenticated path traversal enabling arbitrary file write) and the CVSS scoring. Specific endpoint names, file paths, or command patterns used in the scenarios are illustrative of the attack class and should not be treated as confirmed technical details.

Impact Assessment

Business Impact

• Integrity Impact (High): Arbitrary file write allows the attacker to modify operating system files, potentially altering device configuration, firmware, or monitoring data, leading to persistent device compromise.
• Confidentiality Impact (High): While the primary primitive is file write, subsequent code execution enables data exfiltration of network configuration, credentials, and traffic inspection data.
• Availability Impact (High): A malicious actor could overwrite critical system files, causing service disruption, denial of service, or permanent device bricking requiring hardware replacement.

Affected Systems

• All AOS-CX powered switching platforms, including Aruba CX 4100i, 6200F, 6300F/M, 6400, 8320, 8325, and 8360 series switches.
• Management interfaces exposing the vulnerable API endpoints, including REST APIs, SNMP-based management, and web-based UI backends.

Blast Radius

• Network Scope: Compromised switches act as critical chokepoints; an attacker controlling the switch can intercept, redirect, or black-hole traffic across the network segments the device serves.
• Lateral Movement: The management plane of an enterprise network often shares trust boundaries with other infrastructure; a compromised switch can serve as a foothold for lateral movement into adjacent systems.
• Supply Chain: In managed service provider environments, a single compromised AOS-CX device could expose multiple downstream customer networks.

CVSS Interpretation

The CVSS:3.1 score of 7.2 reflects:

• Network exploitability (AV:N) from the management network.
• High privilege requirement (PR:H) limiting the attack to authenticated administrators.
• No user interaction (UI:N) required.
• Unchanged scope (S:U) — the compromise remains within the switch.

Detection Guidance

Sigma Rule

title: AOS-CX Path Traversal Attempt via API
id: 8f7e2a91-6b3d-4c5e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects path traversal sequences in API requests targeting AOS-CX management endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73765
author: Valters IT Security Team
date: 2026/02/15
tags:
    - attack.t1213
    - attack.credential_access
logsource:
    category: webserver
    product: aruba_aoscx
    service: api
detection:
    selection_base:
        cs-method:
            - 'POST'
            - 'PUT'
            - 'PATCH'
    selection_path:
        cs-uri-query|contains:
            - '..%2f'
            - '..%2F'
            - '%2e%2e%2f'
            - '%2e%2e%2F'
            - '..\\'
            - '..\/'
            - '.../'
            - '....//'
    selection_transversal:
        cs-uri-query|contains:
            - '/etc/'
            - '/var/'
            - '/usr/'
            - '/boot/'
            - '/proc/'
    condition: selection_base and selection_path and selection_transversal
    timeframe: 1m
level: high
falsepositives:
    - Legitimate administrative operations referencing system paths
    - Backup and restore functions that reference absolute paths
fields:
    - clientip
    - cs-uri-query
    - cs-method
    - sc-status

YARA Rule

rule AOSCX_PathTraversal_API {
    meta:
        author = "Valters IT Security Team"
        description = "Detects path traversal payloads targeting AOS-CX API file write endpoints"
        reference = "CVE-2026-73765"
        date = "2026-02-15"
        severity = "high"

    strings:
        $traversal1 = "..%2f" ascii wide
        $traversal2 = "..%2F" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide
        $traversal4 = "%2e%2e%2F" ascii wide
        $traversal5 = "....//" ascii wide
        $traversal6 = "..\\" ascii wide
        $traversal7 = "../" ascii wide
        $write_keywords1 = "write" ascii wide
        $write_keywords2 = "upload" ascii wide
        $write_keywords3 = "store" ascii wide
        $write_keywords4 = "save" ascii wide
        $write_keywords5 = "filename" ascii wide
        $write_keywords6 = "filepath" ascii wide
        $write_keywords7 = "path" ascii wide

    condition:
        any of ($traversal*) and any of ($write_keywords*) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73765 - AOS-CX Path Traversal in API Endpoint"; flow:to_server,established; content:"POST"; http_method; content:"..%2f"; http_uri; nocase; content:"..%2F"; http_uri; nocase; content:"%2e%2e%2f"; http_uri; nocase; content:"%2e%2e%2F"; http_uri; nocase; content:"/etc/"; http_uri; nocase; content:"/var/"; http_uri; nocase; content:"/usr/"; http_uri; nocase; reference:cve,2026-73765; classtype:attempted-admin; sid:202673765; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where process.name == "nginx" and destination.port == 443 and
     network.protocol == "http" and
     url.path like "*api*" and
     (url.query like "*..%2f*" or url.query like "*..%2F*" or
      url.query like "*%2e%2e%2f*" or url.query like "*%2e%2e%2F*" or
      url.query like "*..\\*" or url.query like "*....//*")]
  [file where event.action == "write" and
     (file.path like "*/etc/*" or file.path like "*/var/*" or
      file.path like "*/usr/*" or file.path like "*/boot/*" or
      file.path like "*/proc/*") and
     process.executable like "*nginx*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(cs_uri_query, "%..%2f%") OR like(cs_uri_query, "%..%2F%")
    OR like(cs_uri_query, "%2e%2e%2f%") OR like(cs_uri_query, "%2e%2e%2F%")
    OR like(cs_uri_query, "%..\\%") OR like(cs_uri_query, "%....//%")
| search cs_uri_query IN ("*/etc/*", "*/var/*", "*/usr/*", "*/boot/*", "*/proc/*")
| stats count by src_ip, cs_uri_query, cs_method, sc_status
| where count >= 3
| eval severity = "HIGH"
| table _time, src_ip, cs_uri_query, cs_method, sc_status, count

Wazuh OSSEC Rule

<group name="aoscx-path-traversal,">
  <rule id="854677" level="12">
    <if_sid>31500</if_sid>
    <regex>((\.\.(/|%2f|%2F|\\|\%5c))|(%2e%2e(/|%2f|%2F)))</regex>
    <regex>((/etc/)|(/var/)|(/usr/)|(/boot/)|(/proc/))</regex>
    <description>CVE-2026-73765: AOS-CX API path traversal attempt detected</description>
    <group>attack, exploitation, path_traversal, cve-2026-73765</group>
    <mitre>
      <id>T1213</id>
    </mitre>
    <info type="cve">CVE-2026-73765</info>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

1. Immediate Mitigations (Compensating Controls)

• Restrict API Access: Limit network access to AOS-CX management API endpoints to trusted administrative networks (e.g., dedicated management VLANs) using access control lists (ACLs).
• Enforce Strong Authentication: Implement multi-factor authentication (MFA) for all administrative accounts with API access.
• Monitor Administrative Actions: Enable comprehensive audit logging of all API interactions, focusing on file-write operations and path manipulation attempts.
• Disable Unnecessary Services: Disable unused API endpoints or management services to reduce the attack surface.
• Segment the Management Plane: Isolate management traffic using out-of-band management networks or encrypted tunnels.

2. Patch/Upgrade Steps

• Monitor Vendor Advisories: Regularly check Aruba Networks (HPE) security advisories at https://www.arubanetworks.com/support-services/security-bulletins/ for the official CVE-2026-73765 advisory and patch availability.
• Apply Firmware Updates: Once available, apply the official AOS-CX firmware patch. Deploy in a maintenance window with full backup and rollback capability.
• Verify Integrity: After patching, verify firmware integrity via the device's hash verification mechanisms.

3. Long-Term Hardening

• Adopt Principle of Least Privilege: Limit administrative privileges to personnel requiring them; avoid using shared root-level accounts for daily operations.
• Regular Security Assessments: Conduct periodic penetration testing of network management infrastructure, including API endpoint security testing.
• Credential Hygiene: Implement automated credential rotation for all administrative accounts and service accounts with API access.
• Network Monitoring: Deploy the provided detection rules in SIEM/IDS infrastructure to detect future exploitation attempts.
• Vendor Communication: Engage with Aruba support channels to request direct notification of patch availability and inquire about interim security mitigations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73765
2. Aruba Networks Security Bulletins: https://www.arubanetworks.com/support-services/security-bulletins/
3. CWE-22 (Path Traversal) Definition: https://cwe.mitre.org/data/definitions/22.html
4. MITRE ATT&CK Technique T1213 (Exploitation for Credential Access): https://attack.mitre.org/techniques/T1213/
5. CVSS Calculator for CVE-2026-73765: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Known Threat Activity: No in-the-wild exploitation, public exploit code, or threat actor campaigns have been reported as of the publication date. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the device class (network infrastructure) and the potential for remote code execution, active monitoring and proactive mitigation are strongly recommended despite the lack of public exploitation evidence.