CVE-2026-73753

CVE-2026-73753 is an OS command injection flaw (CWE-78) in HPE's ArubaOS-CX network switch operating system. It is triggered when an authenticated low-privileged user (e.g., an operator or read-only account) runs affected command-line operations, causing injected commands to run with unintended privileges. A successful attacker gains the ability to execute arbitrary commands as a privileged (root-level) user on the switch's underlying operating system, enabling full control of the device. Any organization running HPE ArubaOS-CX switches where low-privileged users have CLI or management access is potentially affected. There is currently no known exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA's KEV, with EPSS estimating only a ~0.4% chance of exploitation in the next 30 days.

What to do: Monitor the HPE security advisory for CVE-2026-73753 and apply the fixed ArubaOS-CX firmware release it specifies as soon as available. In the interim, restrict or remove operator-level (low-privileged) CLI/SSH/WebUI accounts on affected switches and limit management-plane access to trusted admin networks. Audit switch configurations for low-privileged local or AAA-authenticated users with command-line access, since those accounts are the attack vector.