CVE-2026-73773 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Network administrators and security teams responsible for HPE Aruba CX switches should assess and mitigate this vulnerability to prevent potential disruptions. Additionally, operators managing network infrastructure, vulnerability management teams, and security personnel overseeing threat detection and response should be aware of this issue to ensure proper prioritization and remediation efforts.

Technical summary

CVE-2026-73773 is an unauthenticated Denial-of-Service (DoS) vulnerability in the API endpoint of HPE Aruba CX running AOS-CX. The vulnerability allows an attacker to interrupt normal operation of the affected service. HPE Aruba CX switches running AOS-CX versions prior to 10.11.0, 10.13.0, 10.16.1052, 10.17.1022, and 10.18.0001 are vulnerable to an unauthenticated Denial-of-Service (DoS) attack on the API endpoint. Defenders should review the official advisory for specific guidance on patching and validating their environments.

Defensive priority

HPE Aruba CX switches running AOS-CX versions prior to 10.11.0, 10.13.0, 10.16.1052, 10.17.1022, and 10.18.0001 are vulnerable to an unauthenticated Denial-of-Service (DoS) attack on the API endpoint.

Recommended defensive actions

• Apply vendor patches or updates for AOS-CX to remediate the vulnerability.
• Restrict access to the API endpoint.
• Monitor for unusual activity on the network.

Evidence notes

The CVE and NVD records provide details on the vulnerability but do not offer additional information on exploitation or affected configurations beyond listed CPEs. Further verification is needed to understand the full scope of affected systems and potential mitigations. Defenders should review the official advisory for specific guidance on patching and validating their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.