HPE has patched a critical unauthenticated remote code execution vulnerability in ArubaOS-CX, the network operating system powering its enterprise-grade switches. Tracked as CVE-2026-73749, the flaw could allow remote attackers to take full control of affected devices by sending specially crafted packets. Organizations running vulnerable branches should upgrade immediately.
What Happened: Critical RCE Flaw Discovered in HPE ArubaOS-CX Network Switches
On September 3, 2026, Hewlett Packard Enterprise (HPE) published a security bulletin disclosing CVE-2026-73749. The vulnerability is a buffer overflow in a daemon process of ArubaOS-CX. An unauthenticated remote attacker can exploit it by sending malformed packets to the affected service. Consequently, the attacker achieves code execution with elevated privileges on the underlying operating system.
ArubaOS-CX is the operating system for HPE Aruba Networking enterprise switches. These devices are deployed in large businesses, government agencies, universities, healthcare organizations, data centers, and service provider networks. Therefore, a successful exploit could disrupt core network infrastructure and provide attackers with a foothold for lateral movement.
Moreover, the bulletin covers 23 additional vulnerabilities in ArubaOS-CX. Several carry high severity ratings with CVSS scores between 8.1 and 8.8. However, CVE-2026-73749 is the most critical because it requires no authentication and can be triggered remotely.
Technical Details of the CVE-2026-73749 Vulnerability
The root cause is improper processing of malformed input in an ArubaOS-CX daemon process. Specifically, a buffer overflow condition allows an attacker to overwrite memory and inject executable code. Because the daemon runs with elevated privileges, successful exploitation grants the attacker control over the switch operating system.
The attack vector is network-based and requires no user interaction. Furthermore, HPE noted that at the time of disclosure, there was no evidence of active exploitation or publicly available proof-of-concept exploits. However, the high impact and widespread deployment of ArubaOS-CX switches make this a prime target for future exploitation.
Other Notable Vulnerabilities in the Same Bulletin
In addition to CVE-2026-73749, HPE disclosed several other serious flaws:
- CVE-2026-73750: A low-privileged authenticated remote attacker can send malformed input to an AOS-CX management module, potentially causing denial of service or executing code with elevated privileges.
- CVE-2026-73751: A low-privileged authenticated user can submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system.
- CVE-2026-73752: An unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files, potentially leading to remote code execution.
- CVE-2026-73782: An unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX CLI to execute arbitrary code as a privileged user.
- CVE-2026-73778: An unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of a device that remains in its factory-default state.
- CVE-2026-73777: An unauthenticated remote attacker can exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges.
Business and Operational Impact
A successful exploit of CVE-2026-73749 could have severe consequences for affected organizations. Network switches form the backbone of enterprise infrastructure. Therefore, compromising them gives attackers deep visibility and control over traffic flows.
- Network Disruption: Attackers could reconfigure switches, create denial-of-service conditions, or redirect traffic.
- Data Exfiltration: Compromised switches could be used to mirror traffic to attacker-controlled endpoints.
- Lateral Movement: A foothold on core networking equipment enables attackers to pivot to other systems on the network.
- Supply Chain Risk: Managed service providers and data centers using ArubaOS-CX could inadvertently expose downstream clients.
Mitigation and Recommendations
HPE strongly encourages customers to upgrade to one of the fixed releases listed in the security bulletin. Patching should be treated as urgent given the critical severity and the privileged access granted upon successful exploitation.
Immediate Actions for Defenders
- Inventory Affected Devices: Identify all ArubaOS-CX switches in your environment and map them to the affected release branches.
- Apply Patches: Upgrade to the fixed versions immediately:
- 10.18.0001 → upgrade to 10.18.1002 or later
- 10.17.1021 and earlier → 10.17.1030 or later
- 10.16.1051 and earlier → 10.16.1060 or later
- 10.13.1180 and earlier → 10.13.1190 or later
- 10.10.1180 and earlier → 10.10.1181 or later
- Verify Default Credentials: Ensure no devices remain in factory-default or post-ZTP states with predictable passwords.
- Segment Management Interfaces: Restrict access to AOS-CX management interfaces to authorized administrative hosts only.
- Monitor for Anomalies: Watch for unexpected configuration changes, traffic mirroring, or unusual SSH sessions on switch management IPs.
Long-Term Recommendations
Furthermore, organizations should adopt a zero-trust approach to network device management. Implement certificate-based authentication where possible. Also, enable centralized logging and alerting for all switch administrative events. Finally, include network operating systems in regular vulnerability management cycles rather than treating them as set-and-forget infrastructure.
Bottom line: CVE-2026-73749 is a critical unauthenticated RCE in widely deployed enterprise switches. Patch now. Do not wait for proof-of-concept code or active exploitation to appear before acting.
Incident Summary
| CVE ID: | CVE-2026-73749 |
| Affected Systems: | HPE ArubaOS-CX network switches (versions 10.10, 10.13, 10.16, 10.17, 10.18) |
| Vulnerability Type: | Buffer Overflow / Remote Code Execution |
| CVSS Severity: | Critical |
| Disclosure Date: | September 3, 2026 |
| Patch Status: | Patches available; upgrade to fixed versions listed above |
| Exploitation Status: | No active exploitation or public PoC reported at time of disclosure |
References
- Bill Toulas, BleepingComputer, “HPE patches critical ArubaOS-CX remote code execution flaw,” September 3, 2026, https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/, accessed September 3, 2026.
- Hewlett Packard Enterprise, “HPE Aruba Networking AOS-CX Multiple Vulnerabilities,” Security Bulletin, September 3, 2026, https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us, accessed September 3, 2026.
- National Vulnerability Database (NVD), CVE-2026-73749, https://nvd.nist.gov/vuln/detail/CVE-2026-73749, accessed September 3, 2026.
