CVE-2026-73767

Executive Summary

CVE-2026-73767 describes authenticated command injection vulnerabilities in the command line interface (CLI) of AOS-CX, the operating system powering HPE Aruba networking switches. Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands with elevated (privileged user) privileges on the underlying OS. With a CVSS score of 7.2 and high confidentiality, integrity, and availability impact, this vulnerability poses significant risk to enterprise networks that rely on Aruba CX switching infrastructure. Public PoC material exists, although no active exploitation campaigns have been confirmed (EPSS percentile: 61.0%).

Technical Analysis

The vulnerability class is command injection (CWE-78) within the command line interface of AOS-CX. Command injection vulnerabilities of this nature arise when user-supplied input is insufficiently sanitized before being passed to an operating system shell or command execution context.

Attack Surface: The attack surface is the CLI of AOS-CX devices. The CLI is accessible via:

• Local console access
• SSH (Secure Shell) sessions
• Serial connections
• Potentially via management APIs that funnel into the same command-processing logic

Authentication Requirement: The CVSS vector indicates PR:H (High Privileges Required), meaning the attacker must already possess an authenticated account with elevated privileges on the device. However, the NVD description notes that successful exploitation allows execution of cascading commands at a privileged-user level on the underlying operating system — suggesting the injection privilege boundary sits between the CLI application context and the OS shell.

Mechanism: An authenticated user issuing commands through the AOS-CX CLI can manipulate arguments or parameters in such a way that shell metacharacters (e.g., ;, &&, |, backticks, $()) are concatenated with the intended command. When the CLI passes the constructed string to the underlying OS command interpreter, the injected content executes as arbitrary shell commands. Since the CLI process runs in a privileged context (to manage the switch OS), the injected commands inherit those elevated privileges, granting the attacker full control over the underlying operating system.

Technical Detail Availability: The NVD description is sparse and does not enumerate the specific commands, input parameters, or functions affected. Per accuracy requirements, no specific function names, endpoints, or code-level examples are fabricated here. What is known is the vulnerability class, the affected interface (CLI), and the privilege level achieved (privileged user on underlying OS).

Exploitation Scenarios

No public PoC is available at the class level for this CVE; attack chain is inferred from the vulnerability class and NVD description.

Attack Chain:

1. Reconnaissance / Target Identification: An attacker with valid credentials for an AOS-CX device identifies the management interface (e.g., SSH port 22 or console management) of a vulnerable switch. Target identification may involve network scanning (Shodan for internet-exposed management interfaces, internal scanning for on-premises network infrastructure). The attacker needs an account with sufficient privilege to reach the CLI (authenticated access).

2. Flaw Trigger: The attacker authenticates to the CLI and initiates commands whose parameters accept user-controlled input. Rather than providing legitimate values, the attacker injects shell metacharacters alongside the intended payload. The CLI's failure to sanitize these metacharacters causes the input to be interpreted as additional OS commands during execution.

3. Payload / Execution Method: At the vulnerability-class level, the payload takes the form of a crafted CLI command argument containing shell control operators appended with attacker-desired commands. For example, a legitimate parameter value such as a filename or interface descriptor might be appended with ; <malicious command> or && <malicious command>. When the OS-level interpreter processes the string, both the original command and the injected command execute.

4. Post-Exploitation Impact: Since the NVD description states the attacker achieves execution as a privileged user on the underlying operating system, the full range of post-exploitation activities becomes available:

   • Installing persistent backdoors or rootkits in the OS layer (outside the CLI application)
   • Exfiltrating configuration data, credentials, cryptographic keys, or network telemetry
   • Modifying switch configuration outside normal CLI audit trails
   • Pivoting into adjacent network segments using the compromised switch as a trusted foothold
   • Disrupting network services (availability impact per CVSS A:H)
   • Capturing network traffic traversing the switch

Impact Assessment

CVSS Analysis (Score: 7.2 High):

• Attack Vector: Network (AV:N) — Remotely exploitable over the network, expanding blast radius beyond physical access.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions required for exploitation.
• Privileges Required: High (PR:H) — Attacker must have an authenticated account with elevated access, limiting exposure to trusted administrators or those with acquired credentials.
• User Interaction: None (UI:N) — No victim action required.
• Scope: Unchanged (S:U) — Impact confined to the affected component.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) — Complete compromise of data confidentiality, configuration integrity, and service availability on the affected device.

Business Impact: AOS-CX is the operating system for HPE Aruba CX-series switches, which form the network backbone in many enterprise and campus networks. Successful exploitation means an attacker gains privileged OS-level access to a network-critical device. This constitutes a critical infrastructure breach in the network layer, enabling:

• Network traffic interception and exfiltration (confidentiality breach of all traversing traffic)
• Reconfiguration of network policies, VLANs, ACLs, and routing (integrity breach)
• Denial of service via configuration destruction or system shutdown (availability breach)
• Lateral movement into deeper network zones using the compromised switch as a trusted pivot node

Blast Radius: The switch's position in the network architecture determines the blast radius. Core/distribution switches carry aggregate traffic from entire network segments — compromising these exposes all traffic flowing through them. Even edge switches present meaningful risk due to their access to physical-layer connections and VLAN boundaries.

EPSS Consideration: EPSS score of 0.01016 (61.0th percentile) suggests modest exploitation likelihood in the near term. However, the existence of public PoC material raises the probability of weaponization. Absence from the CISA KEV list indicates no confirmed in-the-wild exploitation has been officially cataloged.

Detection Guidance

Sigma Rule

title: AOS-CX CLI Command Injection Attempt
id: 2b4f7f38-8d2e-4b7f-3d5d-6c7a9e0c1d2e
status: experimental
description: Detects potential command injection attempts in AOS-CX CLI audit logs
author: Valters IT Security Team
logsource:
    product: hpe
    category: firewall
    service: aos-cx
detection:
    selection:
        EventID: 'CLI_COMMAND'
    keywords:
        - '*;*'
        - '*&&*'
        - '*|*'
        - '*`*'
        - '*$( )*'
        - '*; id*'
        - '*; whoami*'
        - '*& shutdown*'
    condition: selection
    timeframe: 5m
fields:
    - src_ip
    - user
    - command
falsepositives:
    - Legitimate use of semicolons or pipes in configuration values (e.g., banner text)
    - Network configurations containing special characters
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.73767

YARA Rule

rule AOS_CX_Command_Injection_CVE_2026_73767
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects command injection patterns in AOS-CX CLI logs or session captures"
        cve = "CVE-2026-73767"
        date_created = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "; whoami" ascii wide nocase
        $s2 = "; cat /etc/passwd" ascii wide nocase
        $s3 = "; curl " ascii wide nocase
        $s4 = "&& shutdown" ascii wide nocase
        $s5 = "; wget " ascii wide nocase
        $s6 = "; sh -i" ascii wide nocase
        $s7 = "; nc -e" ascii wide nocase
        $s8 = "; bash -c" ascii wide nocase
        $s9 = "$(shutdown" ascii wide nocase
        $s10 = "$(whoami)" ascii wide nocase
        $s11 = "`whoami`" ascii wide nocase
        $s12 = "; python -c" ascii wide nocase
        $s13 = "; perl -e" ascii wide nocase
    condition:
        uint16(0) == 0x0A0B and 2 of them
}

Suricata IDS Rule

alert tcp any any -> $AOS_CX_SERVERS 22 (msg:"CVE-2026-73767 AOS-CX CLI Command Injection Attempt"; flow:established,to_server; content:"whoami"; nocase; content:";"; within:20; filelog:"aos-cx-command-injection.log"; classtype:attempted-admin; sid:7376701; rev:1; reference:cve,2026-73767; metadata:created_at 2026_01_01, updated_at 2026_01_01, target_service ssh;)

Elastic Detection

sequence by source.ip with maxspan=5m
    [authentication where event.action == "authentication_success" and process.name == "sshd" and destination.port == 22]
    [process where event.action == "exec" and process.name == "sh" and host.os.name == "HPE" and
     process.args : ("*;*", "*&&*", "*|*", "*`*", "*$(*") ]

Splunk SPL Query

index=network sourcetype=ssh:auth OR sourcetype=aos-cx:log
| search (src_ip="*" AND user="*")
| where (match(_raw, ".*;\\s*(whoami|id|cat\\s+/etc/passwd|shutdown|reboot|curl|wget|nc|bash|python).*") 
         OR match(_raw, ".*&&\\s*(whoami|id|shutdown|reboot|curl|wget).*")
         OR match(_raw, ".*\\$\\s*\\(.*\\).*")
         OR match(_raw, ".*`.*whoami.*`.*"))
| eval suspicious=true
| stats count min(_time) as first_seen max(_time) as last_seen by user, src_ip, _raw
| sort -count

Wazuh OSSEC Rule

<group name="aos-cx,">
    <rule id="328500" level="15">
        <decoded_as>syslog</decoded_as>
        <regex>CLI.*(whoami|;.*shutdown|;.*reboot|/etc/passwd|&&|`.*`|\$\(.*\)|nc |curl |wget )</regex>
        <description>CVE-2026-73767: AOS-CX CLI command injection attempt detected</description>
        <group>attack.t1059,attack.t1068,cve_2026-73767,</group>
        <mitre>
            <id>T1059</id>
            <id>T1068</id>
        </mitre>
    </rule>
    <rule id="328501" level="10">
        <regex>CLI</regex>
        <field name="command">\.(sh|bash|python|perl|nc)\s</field>
        <description>CVE-2026-73767: Suspicious privileged command execution on AOS-CX platform</description>
        <group>attack.t1059,cve_2026-73767,</group>
        <mitre>
            <id>T1059</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — a single source (NVD) claims a patch exists, but this has not been independently confirmed. Verify directly with HPE before assuming remediation is available.

Immediate Mitigations:

1. Credential Hygiene: Since this vulnerability requires High Privileges (PR:H), review and restrict all accounts with elevated access to AOS-CX devices. Enforce strong passwords, disable unused accounts, and revoke access for departed administrators.
2. Enable Multi-Factor Authentication (MFA): MFA significantly reduces the risk of credential compromise being used to satisfy the authentication requirement.
3. Network Segmentation: Restrict network access to AOS-CX management interfaces (CLI via SSH/console) to trusted administrative networks only. Use ACLs, firewalls, and VLAN isolation to prevent unauthorized network paths to management ports.
4. Disable/restrict remote CLI access: Where feasible, disable direct SSH CLI access to switch management planes and require jump-host or out-of-band management infrastructure.
5. Monitor CLI access and command audit logs: Enable comprehensive CLI auditing and centralize logs to a SIEM for real-time detection of anomalous command patterns.

Patch/Upgrade Steps:

1. Contact HPE Aruba support or consult the HPE Aruba Networking Security Advisory portal to obtain the official patch or fixed AOS-CX version.
2. Confirm the patch applies to the specific AOS-CX version running on your devices.
3. Stage the upgrade in a lab/test environment with representative switch models.
4. Execute the upgrade during scheduled maintenance windows; follow HPE's documented upgrade procedures for AOS-CX.
5. Verify the upgrade successfully and that CLI commands retain expected functionality.
6. If no patch exists from your vendor, request an ETA and implement robust temporary mitigations.

Long-Term Hardening:

1. Adopt Role-Based Access Control (RBAC): Implement least-privilege models for CLI access; only a minimal set of administrators should hold privileged user roles.
2. Use Centralized Authentication (TACACS+/RADIUS): Centralize authentication and authorization to enforce policy consistently and enable comprehensive audit trails.
3. Vendor Advisory Subscription: Subscribe to HPE Aruba security advisories and monitor CVE feeds for prompt awareness of new patched holes.
4. Network Device Baseline: Maintain a hardened baseline configuration for all network devices, following vendor security hardening guides.
5. Annual credential review: Periodically audit credentials with access to infrastructure devices and rotate administrative credentials.
6. Segment network infrastructure management: Place infrastructure management in a dedicated management VRF/VLAN with strictly controlled access.
7. Test rollback/downgrade paths: Ensure battle-tested configuration backups allow rapid recovery if a patch introduces instability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73767
2. CWE-78 Reference: https://cwe.mitre.org/data/definitions/78.html
3. HPE Aruba Networking Security Advisories: https://www.arubanetworks.com/support-services/security-bulletins/
4. ATLAS — CVE-2026-73767: https://atlas.cisa.gov/
5. Shodan AOS-CX Search: https://www.shodan.io/search?query=product%3A%22ArubaOS-CX%22

Threat Actor Activity / Exploitation Evidence: CVE-2026-73767 is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score (0.01016; 61.0th percentile) and public PoC availability suggest developing risk. No named threat actor campaigns have been publicly attributed to this CVE at the time of writing. Public PoC exists, raising the likelihood of weaponization in the coming months.