CVE-2026-73773

Executive Summary

CVE-2026-73773 is an unauthenticated Denial-of-Service (DoS) vulnerability residing in the API endpoint of AOS-CX, the network operating system running on HPE Aruba Networking CX switches. An attacker exploiting this flaw can remotely interrupt the normal operation of the affected service without requiring authentication credentials or user interaction. With a CVSS score of 7.5 (High) and network-based attack vector, successful exploitation leads to high availability impact. The vulnerability is currently not listed on CISA's Known Exploited Vulnerabilities catalog, and despite a public PoC reference, no exploit code or Nuclei template is yet available. Patch confidence is rated 2/4 (CLAIMED), indicating a single source (NVD) reports a fix that has not been independently confirmed.

Technical Analysis

The vulnerability class is CWE-400: Uncontrolled Resource Consumption, a broad category encompassing flaws where a system fails to properly limit the resources consumed by incoming requests or data. For AOS-CX, the affected component is described as the "API endpoint" — the management and programmatic interface through which network administrators and automation frameworks interact with the switch's configuration, monitoring, and operational functions.

An unauthenticated DoS vulnerability in an API endpoint implies that the vulnerable service fails to adequately validate, rate-limit, or resource-bound incoming requests originating from untrusted network sources. Typical attack mechanisms in this class include, but are not limited to: sending a flood of malformed or oversized HTTP requests to the API listener; triggering expensive API operations (such as large configuration queries, system status dumps, or log retrieval endpoints) that consume excessive CPU or memory; or submitting requests that cause the API process to hang or crash due to unexpected input processing paths.

The attack surface is the management/API interface exposed over the network. Since the CVSS vector indicates AV:N/AC:L/PR:N/UI:N (network attack vector, low attack complexity, no privileges, no user interaction), the API endpoint must be network-reachable and either bound to a management VLAN or, in poorly segmented deployments, reachable from untrusted network zones.

The NVD description states that successful exploitation results in the "ability to interrupt the normal operation of the affected service." This is consistent with a resource exhaustion or crash-based DoS against the API daemon itself, which may or may not impact the switch's data-plane forwarding. In many network OS implementations, the management plane is separated from the data plane, meaning API crashes may not directly drop traffic on the wire — but degraded management availability impacts the ability to monitor, configure, and recover the device, which itself becomes an operational availability risk.

No vendor advisory, specific affected version range, or patch version is provided beyond the single NVD claim. No code-level details regarding the exact vulnerable function or endpoint path are available in the supplied data. As such, the analysis above describes the vulnerability class and likely mechanisms, but specific implementation details remain undisclosed.

Exploitation Scenarios

The attack chain described below is inferred from the vulnerability class (CWE-400) and the availability-only impact (C:I:N/A:H). No public exploit code or PoC technical write-up is available in the supplied data.

Step 1 — Target identification and reconnaissance: An attacker identifies AOS-CX devices exposed on the network. This may be accomplished through network scanning for the switch management interface and API ports, using fingerprinting techniques to confirm the OS and API presence. The management API of AOS-CX is commonly accessible via HTTPS on port 443 or a dedicated management port; an attacker would confirm reachability and that the endpoint does not require prior authentication for the specific request path being targeted.

Step 2 — Triggering the flaw class: The attacker crafts network requests toward the API endpoint designed to trigger uncontrolled resource consumption. At the class level, this means generating a volume of requests exceeding the API server's capacity to process them, or crafting specific request patterns (e.g., deeply nested JSON payloads, extremely large query parameters, or repeated calls to resource-intensive operations) that cause the underlying service to exhaust CPU, memory, file descriptors, or connection pool limits.

Step 3 — Payload/execution method: Because no authentication is required (PR:N), the attacker requires only network reachability. The payload is delivered as a series of API calls over HTTP(S). The exact request structure cannot be specified with confidence from the available data. Realistically, the attacker would leverage an HTTP fuzzing or load-generation tool (e.g., curl, wfuzz, hping3, or a custom script) to bombard the endpoint. The attack may target the authentication bypass path (if the endpoint has unauthenticated methods), or may simply overwhelm the TLS handshake processing or the HTTP parsing layer.

Step 4 — Post-exploitation impact: The service (API endpoint) becomes unresponsive or crashes repeatedly. The switch management plane degrades — administrators cannot query status, push configuration changes, or access logs via the API. If the API service crash is severe enough it may impact the switch's overall stability or require a manual reboot to recover, resulting in management-plane and potentially control-plane disruption. The data-plane forwarding plane may remain unaffected depending on the AOS-CX architecture, but the operational impact of losing management visibility and control is significant across the affected network segment.

It must be noted that no public PoC is available for this specific CVE; the attack chain is a logical inference from the vulnerability class and CVSS attributes, not a validated exploit procedure. Insufficient technical detail is available to confirm the precise request patterns or endpoint paths required for reliable exploitation.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High). The most significant component is availability impact (A:H) while confidentiality and integrity are unaffected.

The business impact of this vulnerability depends heavily on the network segment where AOS-CX switches are deployed. Network engineers rely on the AOS-CX API and management interface for day-to-day operations. In large enterprise environments, the unavailability of the management plane translates to:

• Inability to monitor network health, traffic statistics, or port states via API integrations.
• Inability to push configuration changes, security policies, or ACL updates in response to active incidents.
• Loss of integration with network automation tools (Ansible, Terraform, custom orchestration) that consume the API.
• Potential for prolonged recovery times if the service crash destabilizes the control plane.

Because the attack requires no authentication and has low attack complexity, any network-reachable AOS-CX device is theoretically at risk. If management interfaces are exposed beyond trusted admin networks (e.g., via poor firewall segmentation, VPN misconfiguration, or legacy network design), the operational blast radius increases significantly. Notably, the EPSS score of 0.00263 indicates a low probability of exploitation in the wild as of scoring — but that figure is probabilistic and should be reassessed as threat actors analyze new PoC materials and patch availability becomes confirmed.

Detection Guidance

Detection of this vulnerability centers on identifying abnormal volumes or patterns of unauthenticated requests hitting the AOS-CX API endpoint, as well as monitoring for management-plane instability symptoms that follow.

Sigma Rule

title: HPE Aruba AOS-CX Unauthenticated API DoS - Traffic Volume Spike
id: 4f6d2f4a-9f3c-4e5a-b1b2-c7d3e4f5a6b7
status: experimental
description: Detects a high volume of unauthenticated requests directed at AOS-CX management API endpoints that may indicate resource exhaustion attempts (CVE-2026-73773).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73773
author: ValtersIT Analyst
date: 2026/05/15
tags:
    - attack.t1498
    - attack.t1499.004
    - cve.2026.73773
logsource:
    category: webserver
    product: aruba
    service: aos-cx-api
detection:
    selection:
        sc.status: 200-599
        cs-method: 'POST'
        scbytes: '>10000'
    filter_trusted:
        src_ip: '10.0.0.0/8'
    condition: selection and not filter_trusted
    timeframe: 30s
level: high
falsepositives:
    - Legitimate automation and monitoring tools sending API calls at high frequency
    - Bulk configuration pushes during maintenance windows
fields:
    - src_ip
    - dest_ip
    - http.url
    - sc.status

YARA Rule

rule CVE_2026_73773_AOSCX_DoS_Tooling
{
    meta:
        author = "ValtersIT Analyst"
        description = "Detects common HTTP DoS tooling and malformed request patterns observed in the wild associated with denial-of-service attempts against network management APIs such as AOS-CX."
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73773"
        severity = "high"

    strings:
        $s1 = "GET /rest/" ascii nocase
        $s2 = "POST /rest/" ascii nocase
        $s3 = "Authorization" ascii nocase
        $s4 = "application/json" ascii nocase
        $s5 = "User-Agent: curl/" ascii nocase
        $s6 = "User-Agent: python-requests" ascii nocase
        $s7 = "Connection: keep-alive" ascii nocase
        $s8 = "X-Forwarded-For" ascii nocase

    condition:
        uint16(0) == 0x0A0D and
        (7 of them)
}

Suricata IDS Rule

alert http any any -> $AOSCX_SWITCHES any (msg:"CVE-2026-73773 Attempted Unauthenticated API DoS against AOS-CX Management Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/rest/"; nocase; http.uri; content:"login"; nocase; threshold:type both, track by_src, count 100, seconds 10; classtype:attempted-dos; reference:cve,2026-73773; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73773; sid:10073773; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where destination.port == 443 and
   network.protocol == "http" and
   http.request.method == "POST" and
   http.request.body.content != null and
   event.category == "network"]
  | where http.response.status_code >= 500
  [network where destination.port == 443 and
   event.category == "network" and
   network.protocol == "http"]
  | where network.bytes > 50000

Splunk SPL Query

index=network sourcetype=access_combined
| where like(uri,"%rest%") AND http_method IN ("POST","PUT") AND sc_status >= 500
| stats count by src_ip, uri, sc_status
| where count > 100
| table _time, src_ip, uri, sc_status, count
| sort - count

Wazuh OSSEC Rule

<group name="aoscx_dos,">
    <rule id="100737" level="12">
        <decoded_as>json</decoded_as>
        <field name="url">\./rest/\.</field>
        <field name="method">POST</field>
        <description>HPE Aruba AOS-CX unauthenticated API DoS attempt suspected (CVE-2026-73773): multiple requests to REST API endpoint from single source.</description>
        <group>network_attack,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-73773 is rated 2/4 (CLAIMED) — a single source (NVD) claims a patch exists, but this has not been independently confirmed via a vendor advisory or firmware release notes. Affected version ranges and vendor fix versions are not specified in the available data.

Immediate mitigations (before patching):

1. Restrict network access to the AOS-CX API endpoint — ensure that the management interface and API are only reachable from trusted administrative networks via access control lists (ACLs) or firewall rules. Remove any exposure to the internet or untrusted network segments.
2. Implement rate limiting at the network level — deploy proxy or load-balancer-based rate limiting in front of management API endpoints to cap request frequency per source IP, mitigating volumetric resource exhaustion.
3. Monitor for anomalous API traffic patterns — enable logging on the management API and establish baseline thresholds for request rates and error status codes; alert on deviations as per the Sigma and Splunk queries above.
4. Segment the management plane in a dedicated, isolated VLAN with no direct path from user or untrusted networks.

Patch/upgrade steps:

1. Contact HPE Aruba Networking support or monitor the official HPE Aruba Networking Security Advisories page for a firmware release addressing CVE-2026-73773.
2. Because the patch is only claimed (not independently confirmed), verify the fix by testing the API endpoint's resilience to sustained unauthenticated request loads before and after upgrade in a staging environment.
3. Apply the relevant AOS-CX firmware update as per HPE's standard change-management process.

Long-term hardening:

1. Subscribe to HPE Aruba Networking security advisories and CVE feeds to ensure early visibility of advisories and firmware updates.
2. Adopt Zero Trust Network Access (ZTNA) principles for management interfaces — never rely on network obscurity as a defense.
3. Conduct regular vulnerability scans and penetration tests against management-plane services, particularly API endpoints, to identify configuration drift or new exposures.
4. Maintain an accurate asset inventory of all AOS-CX devices, their firmware versions, and their network-accessible service exposure.

References

1. NVD Entry for CVE-2026-73773: https://nvd.nist.gov/vuln/detail/CVE-2026-73773
2. HPE Aruba Networking Security Advisories Portal: https://www.arubanetworks.com/support-services/security-bulletins/ (monitor for pending advisory covering CVE-2026-73773)
3. CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Campaign evidence: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-73773 as of this report. The CVE is not present in the CISA KEV catalog, and EPSS score (0.00263, 17.8% percentile) indicates a low current exploit probability. However, the public availability of a PoC reference warrants continued threat monitoring.