Hewlett Packard Enterprise (HPE) has fixed a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.
Tracked as CVE-2026-73749, the security issue is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process, achieving elevated code execution.
“Multiple vulnerabilities exist in the ArubaOS-CX daemon that could allow malformed input to be handled incorrectly,” reads the HPE newsletter.
“An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service.”
The affected release branches and fixes listed in the bulletin are:
- 10.18.0001 → upgrade to 10.18.1002+
- 17.10.1021 and earlier → 17.10.1030+
- 16.10.1051 and earlier → 16.10.1060+
- 13.10.1180 and earlier → 13.10.1190+
- 10.10.1180 and earlier → 10.10.1181+
HPE noted that AOS-CX 10.10.1181 has reached End of Support (EOM) and is only receiving fixes for internally discovered, critical issues, a condition that also applies to CVE-2026-73749.
ArubaOS-CX is HPE Aruba Networking’s operating system for its enterprise-class network switches typically used by large businesses, government agencies, universities, healthcare organizations, data centers and service providers.
HPE’s security bulletin also covers a set of 23 other security vulnerabilities, some of high severity, between 8.1 and 8.8:
- CVE-2026-73750: An authenticated, low-privileged remote attacker could send malformed or truncated input to an AOS-CX management module, potentially causing a denial of service or elevated code execution.
- CVE-2026-73751: An authenticated low-privilege user can submit input via the web-based AOS-CX management interface to execute arbitrary commands on the underlying operating system.
- CVE-2026-73752: An unauthorized attacker with access to an adjacent network could use an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.
- CVE-2026-73753: An authenticated user with low privileges can use the affected AOS-CX command line operations to execute arbitrary commands as a privileged user of the underlying operating system.
- CVE-2026-73782: An unauthorized attacker with access to an adjacent network could exploit a format string vulnerability in the AOS-CX CLI to execute arbitrary code as a privileged user of the underlying operating system.
- CVE-2026-73781: An authenticated remote attacker could exploit a stored cross-site scripting vulnerability in the AOS-CX web-based management interface to execute arbitrary script in an administrator’s browser if the administrator interacts with the affected content.
- CVE-2026-73780: An unauthorized remote attacker could exploit missing CSRF protections in some certificate-authenticated AOS-CX sessions to submit arbitrary logins to the web-based management interface by convincing an authenticated user to open a crafted URL.
- CVE-2026-73779: An unauthorized attacker with access to an adjacent network can bypass authentication controls on AOS-CX switches, potentially exposing sensitive information, allowing unauthorized modifications, and disrupting services.
- CVE-2026-73778: An unauthorized remote attacker could use a predictable factory default password to gain full administrative control of an AOS-CX device that remains in its factory state or post-ZTP state before an administrator configures credentials.
- CVE-2026-73777: An unauthorized remote attacker could exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges.
The vendor “strongly encourages” customers to upgrade to one of the fixed versions listed in the bulletin.
HPE mentions that at the time of publishing the bulletin, it was not aware of any active exploitation or publicly available proof-of-concept exploits targeting the listed flaws.
Generic prevention scores can hide what happens after initial access. Once attackers use valid credentials, prevention plummets.
The 2026 Blue Report measures security techniques by techniques in 338 million simulations run in customer production environments.
