CVE-2026-73776

CVE-2026-73776 is a signature verification bypass (CWE-347) in the command line interface of HPE's ArubaOS-CX network operating system, which runs on Aruba's CX-series campus and data center switches. An authenticated actor who already holds administrative privileges in the switch CLI can trigger the flaw, but exploitation also depends on pre-conditions outside the attacker's control, so it is not reliably exploitable on demand. When it succeeds, the attacker breaks out of the CLI's boundary and executes arbitrary code on the switch's underlying operating system (reflected in the CVSS scope change), with high confidentiality and integrity impact. Any organization running AOS-CX switches is potentially affected, though risk is confined to administrative CLI access paths (SSH, console, or the management network) rather than ordinary network traffic. No public proof-of-concept, no CISA KEV listing, and an EPSS of 0.1% indicate exploitation has not yet been observed.

What to do: Monitor for and apply the HPE AOS-CX advisory firmware update when published (no fixed version is provided in the source data). Until then, restrict administrative CLI access to trusted administrators via SSH with AAA/TACACS+ logging, limit management-plane network reachability (management VLAN/ACLs), and review admin accounts for compromise. Check switches for unexplained administrative CLI sessions or unexpected software/configuration changes.