ArubaOS-CX Critical Vulnerability Exposes HPE Switches to Remote Code Execution

Hewlett Packard Enterprise has fixed a critical vulnerability in ArubaOS-CX, the operating system used by HPE Aruba Networking enterprise switches. The flaw, tracked as CVE-2026-73749, could allow a remote, unauthenticated attacker to execute code with elevated privileges.

The vulnerability was disclosed on September 3, 2026, and carries a CVSS score of 9.8 out of 10. HPE is not aware of active exploitation or publicly available proof-of-concept code, but the technical characteristics of the flaw make it a priority to update devices reachable over the network.

The advisory also addresses 23 additional vulnerabilities, some of which enable command injection, authentication bypass, arbitrary file write, and privilege escalation.

Unauthenticated buffer overflow

CVE-2026-73749 results from unsafe handling of input received by an ArubaOS-CX daemon. An attacker can send specially crafted packets to the vulnerable process, triggering a buffer overflow and potentially executing code on the switch.

No credentials or administrator interaction are required. However, the attacker must be able to reach the affected service over the network.

The CVSS vector — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — describes a remote, low-complexity attack requiring no initial privileges. The expected impact is high across confidentiality, integrity, and availability.

The advisory does not specify which packets or protocols trigger the flaw, nor does it publicly identify the affected daemon. HPE has also not provided specific indicators of compromise, network signatures, or input sequences for detection activities.

A compromise with elevated privileges could allow an attacker to modify the device configuration, interfere with management functions, or disrupt traffic. The consequences also depend on the switch’s role in the network and on how administrative interfaces are segmented.

ArubaOS-CX is used in enterprise networks, data centers, universities, healthcare facilities, government agencies, and service providers. A successful attack against a core switch could therefore have broader consequences than the compromise of a single device.

Versions requiring immediate updates

HPE has identified the releases containing fixes for each supported branch:

Vulnerable version or branch	Minimum fixed release
10.18.0001	10.18.1002 or later
10.17.1021 and earlier	10.17.1030 or later
10.16.1051 and earlier	10.16.1060 or later
10.13.1180 and earlier	10.13.1190 or later
10.10.1180 and earlier	10.10.1181 or later

The mitigation recommended by the vendor is to install at least the fixed version available for the branch in use. HPE has not described an equivalent workaround.

The AOS-CX 10.10 branch deserves particular attention. Release 10.10.1181 has already reached End of Maintenance status and receives only limited fixes for critical issues identified internally by HPE. CVE-2026-73749 falls within this exception, but remaining on an EOM release leaves less flexibility for addressing future vulnerabilities.

After installation, administrators should verify the version actually running on every switch. In redundant environments, updates should be scheduled with reboots, failover events, and potential control-plane disruptions in mind.

Not just CVE-2026-73749: the advisory covers multiple attack surfaces

The other fixed vulnerabilities show that the risk is not limited to a single service. The affected components include the web interface, APIs, command-line interface, management modules, authentication mechanisms, and initial provisioning procedures.

The flaws rated CVSS 8.8 include:

• CVE-2026-73750, which allows a remote low-privileged user to send malformed or incomplete input to a management module. Potential consequences include denial of service or privileged code execution.
• CVE-2026-73751, a command injection flaw in the web interface that can be exploited by an account with limited privileges.
• CVE-2026-73752, which allows an unauthenticated attacker on the adjacent network to write arbitrary files through an API endpoint, potentially enabling subsequent code execution.
• CVE-2026-73753, which allows a low-privileged user to abuse CLI operations and execute commands as a privileged user.
• CVE-2026-73782, a format string vulnerability in the CLI that can be exploited without authentication from an adjacent network to execute privileged code.

The adjacent-network requirement limits the exposure of CVE-2026-73752 and CVE-2026-73782 compared with a fully remote vulnerability. However, it does not eliminate the risk on shared local networks, accessible management segments, or environments where an attacker has already compromised another system.

Other issues directly affect authentication and administrative sessions. CVE-2026-73779 could allow authentication checks to be bypassed, while CVE-2026-73777 allows access controls on an API endpoint to be bypassed and privileges to be elevated.

CVE-2026-73778 instead exploits a predictable default password. The risk affects devices that remain in their factory state or are still in the period following Zero Touch Provisioning, before new credentials have been configured.

On the web side, CVE-2026-73781, rated CVSS 8.4, is a stored cross-site scripting vulnerability requiring administrator interaction. CVE-2026-73780, with a CVSS score of 8.3, exploits missing CSRF protections in certain certificate-authenticated sessions. The victim must open a URL prepared by the attacker.

No known attacks, but no ready-to-use indicators

At the time of publication, HPE said it had no evidence of active exploitation. There are also no known public proof-of-concept exploits targeting the listed vulnerabilities.

HPE has not indicated that CVE-2026-73749 has been added to CISA’s Known Exploited Vulnerabilities catalog. No KEV listing date or associated federal deadline is therefore available. The current situation distinguishes the flaw from a vulnerability confirmed to be under active exploitation, without making remediation any less urgent.

In the absence of specific indicators, monitoring should focus on anomalous behavior, including unexpected daemon crashes or restarts, malformed input, unusual authentication attempts, unauthorized changes, file creation, and administrative commands that cannot be linked to planned activity.

Organizations should also monitor direct requests to API endpoints and the web interface from networks other than authorized management networks. Any configuration changes, new accounts, modified credentials, or services enabled without authorization require immediate investigation.

Operational measures to reduce exposure

The first step is to identify all ArubaOS-CX switches, including those deployed at branch offices, in laboratories, and on separate management networks. The inventory should include at least the model, software branch, installed release, network role, and exposure of administrative interfaces.

Organizations should then:

1. install the minimum fixed release specified for each branch;
2. plan migration away from systems running the 10.10 branch, which is in End of Maintenance;
3. restrict access to web management, APIs, and the CLI to the necessary management networks;
4. immediately remove default passwords from new or recently ZTP-provisioned devices;
5. review low-privileged accounts, since several flaws allow limited access to be turned into privileged control;
6. collect and centralize switch logs, retaining events from before and after the update;
7. review configurations, files, and administrative activity for signs of changes that may have already occurred.

The importance of valid accounts is also highlighted by the Blue Report 2026, based on 338 million simulations in production environments: when attackers use legitimate credentials, only 37% of their actions are blocked. In the ArubaOS-CX context, this finding is particularly relevant to vulnerabilities requiring minimal initial privileges and subsequently allowing privilege escalation.