CVE-2026-73770

CVE-2026-73770 is an authenticated arbitrary file write flaw (CWE-73, external control of file name or path) in HPE Aruba's AOS-CX network switch operating system. To exploit it, an attacker who already holds high-privileged credentials on the device, with adjacent network access, must write to a path they can influence, and the attack also depends on specific conditions and a required action by another user that the attacker cannot control — a high-complexity, multi-condition trigger. A successful attacker can create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying host operating system of the switch, beyond the switch's own CLI, with high impact to confidentiality, integrity, and availability. All organizations running affected AOS-CX releases are potentially affected, though practical exploitability is limited to environments where an authorized high-privilege account is compromised or abused. No public proof-of-concept, no listing in CISA KEV, and a low EPSS score (0.1%, ~4th percentile) indicate no known exploitation at this time.

What to do: Identify AOS-CX switches in your estate and check the HPE security advisory for this CVE to determine affected and fixed firmware versions, then upgrade to the recommended fixed release when available. In the interim, restrict management-plane access (CLI/API) to trusted administrators, audit accounts holding high-privileged credentials on these switches, and watch for signs of unexpected file changes or commands on the underlying OS. Given the low EPSS and absence of public PoC or KEV listing, standard patch-cycle prioritization is reasonable, with faster action for internet-reachable or high-value management networks.