HPE Patches a Critical Unauthenticated RCE Flaw in Its Aruba Networking Switches

Hewlett Packard Enterprise has patched a critical, unauthenticated remote code execution flaw in ArubaOS-CX, the operating system that runs its Aruba Networking enterprise switches, along with a broad batch of other vulnerabilities disclosed in the same bulletin.

The critical bug, tracked as CVE-2026-73749, carries a CVSS score of 9.8 out of 10. HPE describes it as a set of buffer overflow vulnerabilities in a daemon (a background service) on AOS-CX devices that mishandles malformed input. “An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service,” HPE’s bulletin states, according to BleepingComputer, which reviewed the advisory directly. A successful attack requires no credentials and no user interaction, and it can hand an attacker code execution with elevated privileges on the switch itself.

A daemon flaw with an unusually wide blast radius

ArubaOS-CX runs on Aruba’s CX-series switches, the kind of enterprise-grade networking hardware used by large businesses, government agencies, universities, healthcare systems, data centers, and service providers to route traffic across campuses and data halls. A remote code execution bug in the switch operating system itself, rather than in a peripheral management tool, means a successful exploit could give an attacker a foothold inside the network core rather than at its edge.

HPE’s bulletin, filed under the identifier HPESBNW05134, bundles the buffer overflow issues covered by CVE-2026-73749 together as a single CVE even though they represent multiple distinct bugs in the same daemon. The independent vulnerability-intelligence firm IONIX lists the flaw’s CVSS vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it is remotely exploitable over the network, requires low attack complexity, needs no privileges or user interaction, and threatens full compromise of confidentiality, integrity, and availability.

Dozens more vulnerabilities in the same bulletin

The bulletin does not stop at the one critical bug. Outlets that reviewed HPE’s advisory differ slightly on the exact overall count: BleepingComputer’s rundown, which quotes HPE’s bulletin text directly, describes 23 further vulnerabilities beyond CVE-2026-73749, for 24 CVE identifiers in total. SecurityWeek instead puts the bulletin’s total at 34 CVEs, split into 22 high-severity and 11 medium-severity issues on top of the critical one, and says more than 150 individual flaws are resolved once bugs bundled under a single CVE are counted separately. HPE has not published a plain-language summary that reconciles the two counts, but the remediation advice is identical either way: apply the fixed release for your branch.

Several of the additional bugs that BleepingComputer detailed, drawn from HPE’s own bulletin language, carry high CVSS scores between 8.1 and 8.8:

• CVE-2026-73750: a low-privileged authenticated attacker can send malformed or truncated input to an AOS-CX management module, potentially causing denial of service or code execution with elevated privileges.
• CVE-2026-73751: a low-privileged authenticated user can submit crafted input through the AOS-CX web-based management interface to execute arbitrary commands on the underlying operating system.
• CVE-2026-73752: an unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.
• CVE-2026-73782: an unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX command-line interface to execute arbitrary code as a privileged user.
• CVE-2026-73778: an unauthenticated remote attacker can use a predictable factory-default password to gain full administrative control of a device still in its factory-default or post-Zero Touch Provisioning (ZTP) state, before an administrator has configured real credentials.

The bulletin also covers a stored cross-site scripting bug that an authenticated attacker can use to run arbitrary scripts in an administrator’s browser (CVE-2026-73781), a missing CSRF protection on some certificate-authenticated sessions that an unauthenticated attacker can trigger by luring a logged-in user to a crafted URL (CVE-2026-73780), and an authentication-bypass issue reachable from an adjacent network (CVE-2026-73779). HPE says the majority of the flaws were found internally by its own security team, and that it is not aware of any active exploitation or public proof-of-concept code targeting any of them.

Affected versions and what to do

The fixes apply across five AOS-CX release branches. HPE’s guidance, as relayed by BleepingComputer, lists the following upgrade paths:

• 10.18.0001 and earlier → upgrade to 10.18.1002 or later
• 10.17.1021 and earlier → upgrade to 10.17.1030 or later
• 10.16.1051 and earlier → upgrade to 10.16.1060 or later
• 10.13.1180 and earlier → upgrade to 10.13.1190 or later
• 10.10.1180 and earlier → upgrade to 10.10.1181 or later

That last branch is notable: HPE says the fixed 10.10.1181 release has itself already reached End of Maintenance, meaning the 10.10 branch normally only receives fixes for internally discovered critical issues going forward. CVE-2026-73749 qualified, so HPE issued this one patch anyway, but customers still running that branch should treat it as a signal that this is likely the last update it will get, and plan a move to a supported release rather than staying on EOM software indefinitely.

For anyone who cannot patch immediately, HPE Networking recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, controlling access with firewall policies at layer 3 and above, and enabling accounting controls to track and log user activity and resource usage. The company “strongly encourages” customers to move to one of the fixed releases as soon as practical rather than relying on network segmentation alone.