HPE patches critical ArubaOS-CX remote code execution flaw

Summary

Hewlett Packard Enterprise (HPE) has released patches for a critical remote code execution vulnerability (CVE-2026-73749) in its ArubaOS-CX network operating system. The flaw, a buffer overflow, allows unauthenticated remote attackers to execute code with elevated privileges by sending specially crafted packets. HPE also addressed 23 other vulnerabilities, some with high severity ratings, affecting various aspects of the OS.

Full text

HPE patches critical ArubaOS-CX remote code execution flaw By Bill Toulas September 3, 2026 02:28 PM 0 Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. Tracked as CVE-2026-73749, the security issue is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process, achieving code execution with elevated privileges. “Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input,” reads HPE’s bulletin. “An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service.” Affected release branches and fixes listed in the bulletin are: 10.18.0001 → upgrade to 10.18.1002+ 10.17.1021 and earlier → 10.17.1030+ 10.16.1051 and earlier → 10.16.1060+ 10.13.1180 and earlier → 10.13.1190+ 10.10.1180 and earlier → 10.10.1181+ HPE noted that the AOS-CX 10.10.1181 version has reached End of Maintenance (EOM) and only receives fixes for internally discovered, critical issues, a condition that also applies to CVE-2026-73749. ArubaOS-CX is HPE Aruba Networking’s operating system for its enterprise-grade network switches, typically used by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers. HPE's security bulletin also covers a set of 23 other security vulnerabilities, some with high severity ratings, between 8.1 and 8.8: CVE-2026-73750: A low-privileged authenticated remote attacker can send malformed or truncated input to an AOS-CX management module, potentially causing denial of service or executing code with elevated privileges. CVE-2026-73751: A low-privileged authenticated user can submit crafted input through the AOS-CX web-based management interface to execute arbitrary commands on the underlying operating system. CVE-2026-73752: An unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution. CVE-2026-73753: A low-privileged authenticated user can exploit affected AOS-CX command-line operations to execute arbitrary commands as a privileged user on the underlying operating system. CVE-2026-73782: An unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX command-line interface to execute arbitrary code as a privileged user on the underlying operating system. CVE-2026-73781: An authenticated remote attacker can exploit a stored cross-site scripting vulnerability in the AOS-CX web-based management interface to execute arbitrary scripts in an administrator’s browser if the administrator interacts with the affected content. CVE-2026-73780: An unauthenticated remote attacker can exploit missing CSRF protections in some certificate-authenticated AOS-CX sessions to submit arbitrary input to the web-based management interface by convincing an authenticated user to open a crafted URL. CVE-2026-73779: An unauthenticated attacker with adjacent-network access can bypass authentication controls on AOS-CX switches, potentially exposing sensitive information, enabling unauthorized modifications, and disrupting services. CVE-2026-73778: An unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of an AOS-CX device that remains in its factory-default or post-ZTP state before an administrator configures credentials. CVE-2026-73777: An unauthenticated remote attacker can exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges. The vendor “strongly encourages” customers to upgrade to one of the fixed releases listed in the bulletin. HPE mentions that, at the time of the bulletin’s publication, it was not aware of active exploitation or publicly available proof-of-concept exploits targeting the listed flaws. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical Elementor Pro flaw exploited to take over WordPress sitesHackers exploit Sangoma Switchvox flaw to deploy reverse shellsWordPress backup plugin flaw exposes millions of sites to takeover attacksCritical Langflow flaw exploited to steal OpenAI and AWS keysGogs patches critical zero-day enabling remote code execution

Indicators of Compromise

• cve — CVE-2026-73749
• cve — CVE-2026-73750
• cve — CVE-2026-73751
• cve — CVE-2026-73752
• cve — CVE-2026-73753
• cve — CVE-2026-73782
• cve — CVE-2026-73781
• cve — CVE-2026-73780
• cve — CVE-2026-73779
• cve — CVE-2026-73778
• cve — CVE-2026-73777

Entities