CVE-2026-73780

CVE-2026-73780 is a missing Cross-Site Request Forgery (CSRF) protection flaw (CWE-352) in the web-based management interface of HPE Aruba Networking AOS-CX switches. A remote, unauthenticated attacker who can convince an already-authenticated interface user to interact with a specially crafted URL can have that user's browser silently submit arbitrary input to the switch's management interface. Because these forged requests run with the victim's session, the attacker can execute arbitrary actions against the interface, with the potential for high-impact confidentiality, integrity, and availability consequences reflected in the 8.3 CVSS score. Any organization operating AOS-CX switches whose web management interface is used or reachable is affected, though the provided data does not specify affected version ranges. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Upgrade AOS-CX switches to a fixed release identified in HPE's security advisory for CVE-2026-73780. Until patched, restrict the web-based management interface to trusted management networks or disable it where unused, and caution administrators not to open unsolicited links while logged in to the interface.