CVE-2026-73782

CVE-2026-73782 is a format string vulnerability (CWE-134) in the command line interface of HPE Aruba's AOS-CX network switch operating system. An unauthenticated attacker who can reach the switch CLI from an adjacent network can supply crafted format string input that triggers the flaw, and successful exploitation results in arbitrary code execution as a privileged user on the switch's underlying operating system. This effectively gives the attacker root-level control of the device, enabling configuration changes, traffic interception or manipulation, and potential persistence inside the enterprise network. Any organization running AOS-CX switches is potentially affected, although the specific affected and fixed firmware versions are not stated in the available data. Exploitation is not confirmed in the wild: the flaw is not in CISA's KEV catalog, has no known public proof-of-concept, and carries a low EPSS probability of 0.3%.

What to do: Monitor the HPE security advisory (CNA: [email protected]) for the list of affected AOS-CX versions and upgrade to the fixed firmware release when published. In the meantime, restrict CLI reachability by limiting SSH/telnet management access to trusted management VLANs via ACLs and removing any exposure from user-facing networks, since the attack vector is adjacent. With no public PoC or KEV listing, treating this as standard-cycle patching rather than emergency response is defensible.