HPE AOS-Switch: Authentication bypass in web management interface
Summary
Hewlett Packard Enterprise AOS-Switch (AOS-S), the operating system of several Aruba-branded switch series, contains an authentication bypass in its web management interface. An unauthenticated remote attacker who can reach that interface can gain unauthorized access to the switch, and according to secondary sources possibly full administrative control. No user interaction or credentials are required, so the risk is highest where the web interface is reachable from user networks or the internet.
Affected
- AOS-Switch 16.11.0000 to 16.11.0031 (CNA record; the HPE advisory states 16.11.0031 and below)
- Affected models include Aruba 2530, 2540, 2615, 2620, 2915, 2920, 2930F and 2930M series (list truncated in the source)
- Releases that have reached End of Maintenance are presumed affected and are not covered by the advisory
Fixed in
- Upgrade to AOS-Switch 16.11.0032 or later (HPE advisory HPESBNW05156)
- Fix availability for every model in the list is unconfirmed
Workaround
- No AOS-S-specific workaround confirmed by HPE in the retrieved advisory text
- Interim measure until the upgrade: restrict web and management access to admin hosts on a dedicated management VLAN and block it from the internet
Exploitation
- Not known to be exploited in the wild (CISA SSVC: exploitation none; not listed in KEV per secondary trackers)
- CISA SSVC: automatable yes, technical impact total
- No public proof of concept found; this has not been fully verified
Our recommendation
- Inventory all AOS-S switches and their firmware versions
- Upgrade affected switches to AOS-Switch 16.11.0032 or later
- Replace any switch on an End of Maintenance release, as it has no patch path under this advisory
- Until patched, limit web and management access to admin hosts on an isolated management VLAN and block it from the internet
- Monitor switch logs for unexpected logins or configuration changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05156 support.hpe.com
- CCB Belgium advisory on HPE AOS-S vulnerabilities ccb.belgium.be
- OpenCVE: CVE-2026-76742 app.opencve.io
- Strix: CVE-2026-76742 www.strix.ai
- Securityonline: HPE AOS-Switch vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:01.
Original description (NVD)
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.