CVE-2026-73775

Executive Summary

CVE-2026-73775 describes an information disclosure vulnerability in the API endpoint of HPE ArubaOS CX network switches. An authenticated remote attacker with low-privileged credentials can exploit this flaw to retrieve sensitive information that may be leveraged to escalate access to network services managed by the AOS-CX operating system. The vulnerability carries a CVSS score of 7.7 (High) with a network attack vector and high confidentiality impact, though it does not affect integrity or availability. Given the patch confidence of 2/4 (claimed but not independently confirmed), enterprise teams operating AOS-CX hardware should prioritize verification of patch availability and implement compensating controls until vendor validation is complete.

Technical Analysis

Based on the NVD description, CVE-2026-73775 resides in an API endpoint exposed by the AOS-CX network operating system. The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack mechanism involves insufficient authorization checks within the API layer — specifically, the API does not properly enforce privilege separation when responding to requests, allowing users authenticated with low-privilege accounts to query resources that should be restricted to administrators or higher-privileged roles.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reveals critical characteristics:

• Attack Vector (AV:N): The vulnerable endpoint is reachable over the network, meaning no physical or adjacent access is required.
• Attack Complexity (AC:L): No special conditions, race conditions, or configuration changes are required to exploit the flaw.
• Privileges Required (PR:L): The attacker only needs low-privilege authenticated access — e.g., a read-only or monitoring account on the switch.
• User Interaction (UI:N): No victim interaction is required.
• Scope (S:C): The impact extends beyond the vulnerable component. While the flaw is in the API layer, the compromised resource belongs to the broader AOS-CX managed network environment. This scope change indicates organizational assets beyond the directly vulnerable component may be affected by the confidentiality breach.
• Confidentiality Impact (C:H): Total information disclosure — all restricted data accessible via the API is potentially exposed.

The EPSS score of 0.00266 (18.5th percentile) indicates that exploitation is currently not widespread in the wild. There is no evidence of CISA KEV listing, no public PoC, no Nuclei template, and no exploit code, suggesting active exploitation has not been observed as of the intelligence cut-off.

The NVD description notes that the disclosed information "could be used to potentially gain further access to network services supported by AOS-CX" — this suggests the exposed data may include configuration details, system credentials, network topology information, SNMP community strings, or API access tokens that would enable lateral movement or privilege escalation within the network infrastructure.

Insufficient technical detail is available in the NVD description to pinpoint the specific API endpoint names, HTTP methods, or parameter structures involved. No CNA title was provided to supplement the description. Security teams should therefore treat the entire AOS-CX API surface as potentially impacted until vendor documentation confirms patched versions.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-73775 as of the intelligence gathering date. The attack chain described below is inferred from the vulnerability class (CWE-200 Information Exposure via API) and the CVSS characteristics.

Step 1 — Reconnaissance and Target Identification

An attacker first identifies internet-exposed or internally reachable AOS-CX devices. Shodan and similar search engines index network infrastructure by banners, HTTPS certificates, and device fingerprints. AOS-CX devices typically expose HTTPS-based management interfaces on the default ports. The attacker would also need valid low-privilege credentials — these may be obtained through other means such as default credential guessing, credential stuffing from prior breaches, or social engineering of network administrators.

Step 2 — Triggering the Vulnerability

With a low-privileged authenticated session (e.g., a "monitor" or "read-only" role account), the attacker sends crafted API requests to the AOS-CX management API. The flaw lies in the API server's failure to apply adequate authorization checks on certain resources — the attacker requests data normally reserved for privileged roles. The attack mechanism is specifically an authorization bypass within the API layer — the API fails to differentiate between a low-privilege requester and a high-privilege requester when serving certain resource representations.

Step 3 — Payload/Execution at the Vulnerability-Class Level

Because specific endpoint details are not available in public advisories, the attack is described generically: the attacker enumerates API resources using GET/POST requests with their valid session token, probing for endpoints that return data beyond their authorized scope. This could include iterating through object identifiers that reference configuration, credentials, or system state. Common patterns in such API misconfiguration flaws include predictable resource IDs that allow enumeration of other tenants' or roles' data, or endpoints where access control is only enforced at the UI layer but not the backend API layer.

Step 4 — Post-Exploitation Impact

Upon successful exploitation, the attacker receives sensitive system information. Per the NVD description, this data can be leveraged to gain further access to network services supported by AOS-CX — potentially including credentials for RADIUS/TACACS+ servers, SNMP read/write community strings, neighbor device discovery data (LLDP/CDP), routing protocol secrets, or other administrative credentials. With this information, the attacker can pivot to compromise additional infrastructure — hijacking network management paths, intercepting traffic, or manipulating routing/switching behavior across the enterprise fabric.

Obstacles: The EPSS percentile of 18.5% and absence of public exploit code suggest active exploitation is unlikely at present. Additionally, attacker must already possess valid low-privilege credentials, which reduces the pool of potential attackers.

Impact Assessment

Business Impact: The primary impact is confidentiality compromise with high severity (C:H). AOS-CX powers Aruba data center and campus switching fabrics. The data at risk includes network configuration state that, if disclosed, reveals the architectural blueprint of the enterprise network. In regulated industries, this could contribute to compliance violations if the network configuration reveals segmentation gaps or security control weaknesses.

Blast Radius — the scope change to S:C is material: the impact extends beyond the API process itself to the entire AOS-CX-managed network infrastructure. The retrieved information is a springboard for further attacks, effectively enabling an authenticated low-privilege user to map the network and attempt lateral movement toward higher-value targets such as core routers, firewalls, or network management systems.

Affected Systems: All ArubaOS CX products (switch models running AOS-CX firmware) where the management API is enabled and reachable. No specific version range has been published in the data provided; the affected versions list is empty. Security teams should consider all AOS-CX versions prior to the claimed patch as potentially vulnerable.

CVSS Subscores: The CVSS score of 7.7 reflects High severity driven by the network attack vector, low complexity, and high confidentiality impact with scope change. Integrity (I:N) and Availability (A:N) impacts are nil, meaning this is strictly a data exposure issue with no write or denial-of-service capability.

Detection Guidance

Sigma Rule

title: ArubaOS CX API Unauthorized Sensitive Data Access Attempt
id: 5f8a3c9e-12b4-4a6d-8c1f-2b9e0d4a7f3c
status: experimental
description: Detects potential exploitation of CVE-2026-73775 where a low-privileged user attempts to access sensitive ArubaOS CX API endpoints returning high-privilege data
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73775
author: Valters IT Security Research
date: 2026/01/15
logsource:
    category: application
    product: arubaos_cx
    service: api
detection:
    selection_low_priv:
        user.role|contains: [monitor, read-only, guest, operator, user]
    selection_sensitive_response:
        response.status_code: 200
        response.body|contains: 
            - 'snmp'
            - 'community'
            - 'radius'
            - 'tacacs'
            - 'secret'
            - 'password'
            - 'enable'
            - 'config'
            - 'credential'
            - 'Key'
            - 'auth'
    selection_unusual_volume:
        request.count|gte: 20
    timeframe: 5m
    condition: selection_low_priv and selection_sensitive_response and selection_unusual_volume
level: medium
falsepositives:
    - Legitimate read-only monitoring tools querying API for status metrics
    - Network management scripts using low-privilege service accounts
tags:
    - attack.t1078
    - attack.t1530
    - cve.2026.73775

YARA Rule

rule CVE_2026_73775_ArubaOS_CX_API_Disclosure {
    meta:
        author = "Valters IT Security Research"
        description = "Detects API response artifacts associated with sensitive information exposure in ArubaOS CX switches (CVE-2026-73775)"
        date = "2026-01-15"
        cve = "CVE-2026-73775"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73775"
    strings:
        $s1 = "application/json" ascii nocase
        $s2 = "aoscx" ascii nocase
        $s3 = "snmp-server" ascii nocase
        $s4 = "community" ascii nocase
        $s5 = "radius-server" ascii nocase
        $s6 = "tacacs-server" ascii nocase
        $s7 = "shared-secret" ascii nocase
        $s8 = "enable-password" ascii nocase
        $s9 = "user" ascii nocase
        $s10 = "role" ascii nocase
        $s11 = "privilege" ascii nocase
        $s12 = "api" ascii nocase
        $s13 = "/rest/" ascii nocase
        $s14 = "vsx" ascii nocase
        $s15 = "config-backup" ascii nocase
    condition:
        (uint16(0) == 0x5B7B or uint16(0) == 0x7B7B) and // JSON array/object start
        (4 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8)) and
        (2 of ($s9, $s10, $s11, $s12, $s13, $s14, $s15))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET POLICY ArubaOS CX API Sensitive Data Exposure CVE-2026-73775"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/"; depth:6; http.uri; pcre:"/(config|snmp|radius|tacacs|credential|auth|system)/i"; threshold:type both, track by_src, count 20, seconds 300; reference:cve,2026-73775; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-73775; classtype:attempted-info-leak; sid:2026073775; rev:1;)

Note on network detection: Because CVE-2026-73775 involves authenticated API requests resulting in JSON/XML response bodies, network detection is best suited to POST/GET request paths and response content inspection, when TLS inspection is enabled. Without SSL/TLS interception, detection on encrypted API traffic will be limited to anomalous connection patterns.

Elastic Detection

// Detect multiple API requests to sensitive AOS-CX endpoints from same low-privilege user
sequence by user.name with maxspan=5m
  [network where process.name == "nginx" or process.name == "lighttpd" or
   event.category == "web" and
   url.path : ("/rest/*config*", "/rest/*snmp*", "/rest/*auth*", "/rest/*system*", "/rest/*role*") and
   user.roles : ("monitor", "operator", "guest", "read-only", "user")]
  [network where event.category == "web" and
   url.path : ("/rest/*config*", "/rest/*snmp*", "/rest/*auth*", "/rest/*system*", "/rest/*role*") and
   http.response.status_code == 200]
  [network where event.category == "web" and
   url.path : ("/rest/*config*", "/rest/*snmp*", "/rest/*auth*", "/rest/*system*", "/rest/*role*") and
   http.response.body.content_type == "application/json"]

Splunk SPL Query

index=web sourcetype=arubaos:api OR sourcetype=access_combined
| where role IN ("monitor", "operator", "guest", "read-only", "user", "low-privilege")
| search uri_path IN ("/rest/*config*", "/rest/*snmp*", "/rest/*auth*", "/rest/*system*", "/rest/*role*", "/rest/*credential*", "/rest/*secret*")
| stats count as request_count, values(uri_path) as queried_endpoints,
         dc(uri_path) as unique_endpoints,
         values(response_status) as status_codes by src_ip, user
| where request_count >= 20 OR unique_endpoints >= 5
| eval risk_score = if(match(lower(queried_endpoints), "passw|secret|credential|community|shared"), "HIGH", "MEDIUM")
| table _time, src_ip, user, request_count, unique_endpoints, queried_endpoints, risk_score
| sort - risk_score, -request_count

Wazuh OSSEC Rule

<group name="arubaos,cisco,cve-2026-73775,">
  <rule id="100375" level="10" frequency="20" timeframe="300">
    <if_sid>100000</if_sid>
    <field name="user.role">monitor|read.only|guest|operator|user|low.privilege</field>
    <field name="url">\.*\/rest\/.*(config|snmp|radius|tacacs|auth|credential|system|secret).*</field>
    <field name="response_status">200</field>
    <description>CVE-2026-73775: Low-privilege user made repeated requests to sensitive ArubaOS CX API endpoints that returned success status. Possible information disclosure attempt.</description>
    <group>authentication_failures,attack,cve-2026-73775,info_leak,</group>
    <options>no_full_log</options>
    <mitre>
      <id>T1078</id>
      <id>T1530</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed). The only patch source listed is NVD, and no vendor fix version is provided. Affected versions list is empty. This low confidence rating means the patch may not yet exist, may be incomplete, or the disclosure of its existence may be premature.

Immediate Mitigations (until patch is verified):

1. Restrict API access: Limit the API endpoint to management VLANs and specific authorized admin source IPs only. Disable external API access if network management is performed via SSH/CLI.
2. Audit low-privilege accounts: Review all accounts on AOS-CX devices with role assignments of "monitor", "operator", or lower. Remove accounts no longer needed. Enforce least privilege.
3. Implement RBAC: Ensure that any account with API access is bound to the minimum required privilege; if API is only needed for monitoring, restrict those accounts to read-only specific resources rather than broad access.
4. Network segmentation: Ensure AOS-CX management interfaces are not reachable from user-facing network segments or the internet. Place management on a dedicated, firewalled management VRF/VLAN.
5. EnableView logging and alerting: Enable audit logging on switches and feed to SIEM as transient detection controls.

Patch/Upgrade Steps:

1. Monitor HPE Aruba Security Advisories (arubanetworks.com) for the official advisory corresponding to CVE-2026-73775.
2. Because the affected version range is not published, establish the current version on all AOS-CX devices: show version on the switch CLI.
3. Once HPE releases the patched AOS-CX version, schedule maintenance windows per the change management process. Follow HPE upgrade guidance including backup of current configuration with copy running-config tftp://<server>/backup.cfg before upgrade.
4. After upgrade, verify API access for low-privilege roles no longer returns sensitive resources.
5. Independently confirm the patch via version comparison and functional verification rather than relying solely on the claimed NVD entry.

Long-Term Hardening:

1. Place all switch management (HTTPS/API/SSH/SNMP) on a dedicated management network.
2. Deploy TACACS+/RADIUS centralized authentication to revoke a compromised account rapidly enterprise-wide.
3. Use role-based access control to grant minimal API rights to each user.
4. Implement configuration and change management via authenticated network automation tools (e.g., Ansible/Nautobot) rather than direct individual low-privilege access to API.
5. Periodically audit switch accounts, removing obsolete accounts.
6. Maintain a register of all AOS-CX software versions for rapid patch verification across the fleet.

References

1. NVD Entry for CVE-2026-73775: https://nvd.nist.gov/vuln/detail/CVE-2026-73775
2. HPE Aruba Networking Security Advisories Portal: https://www.arubanetworks.com/support-services/security-bulletins/
3. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-73775 NOT listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS for CVE-2026-73775: https://www.first.org/epss/

Threat Actor Campaigns: No known threat actor campaigns are associated with CVE-2026-73775. No exploit-in-the-wild evidence exists; CISA KEV does not list this CVE, and no public PoC or exploit code is available in the provided intelligence data.