HPE AOS-Switch: Authenticated privilege escalation in API
Summary
AOS-Switch (AOS-S), the switch operating system used on HPE Aruba access and aggregation switches, contains a privilege escalation flaw in its API. An authenticated attacker with a read-only account can gain administrative access to the affected switch. The attacker needs valid credentials and network access to the management interface; no user interaction is required.
Affected
- AOS-S 16.11.0000 to 16.11.0031
- Products that have reached End of Maintenance are presumed affected and are not covered by the advisory.
Fixed in
- AOS-S 16.11.0032 and above (per HPE bulletin HPESBNW05156; per-CVE fix mapping not separately confirmed)
Workaround
- No vendor workaround identified; upgrade is the primary fix.
- Restrict access to the CLI and web management interfaces to a dedicated management VLAN and/or firewall policies.
- Disable or restrict read-only API accounts where possible and limit API access to administrators (third-party guidance, not verified by HPE).
- Monitor audit logs for privilege changes.
Exploitation
- HPE is not aware of public discussion or exploit code as of the advisory date.
- No confirmed active exploitation reported by aggregators or CERT-FR.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; status should be rechecked before closing.
Our recommendation
- Upgrade affected switches to AOS-S 16.11.0032 or later, patching the whole HPE bulletin together.
- Replace switches that have reached End of Maintenance.
- Review and remove unneeded read-only and shared or default accounts.
- Restrict management interface access to a dedicated management VLAN and firewall it from user and guest networks.
- Check the install base for affected 2530/2930-series switches and monitor audit logs for privilege changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05156 support.hpe.com
- HPE CSAF advisory HPESBNW05156 csaf.arubanetworking.hpe.com
- Strix CVE record CVE-2026-76748 www.strix.ai
- CCB Belgium warning on HPE authentication bypass and buffer overflow ccb.belgium.be
- Securityonline: HPE AOS-Switch vulnerabilities securityonline.info
- CyberInsider: HPE Aruba fixes ClearPass and AOS-Switch flaws cyberinsider.co.uk
- OpenCVE CVE-2026-76748 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:38.
Original description (NVD)
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.