HPE Patches Critical ArubaOS‑CX

Overview

Hewlett Packard Enterprise (HPE) has released patches for a critical vulnerability in ArubaOS‑CX, its enterprise‑grade network operating system. Tracked as CVE‑2026‑73749, the flaw is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to a daemon process, achieving remote code execution with elevated privileges.

Vulnerability Details

• CVE‑2026‑73749: Buffer overflow in ArubaOS‑CX daemon.
• Impact: Remote code execution with elevated privileges.
• Attack vector: Specially crafted packets sent to affected services.
• Affected systems: ArubaOS‑CX powering HPE Aruba Networking switches used by enterprises, governments, universities, healthcare, data centers, and service providers.

Affected Versions & Fixes

HPE advises upgrading to the following patched releases:

• 10.18.0001 → 10.18.1002+
• 10.17.1021 and earlier → 10.17.1030+
• 10.16.1051 and earlier → 10.16.1060+
• 10.13.1180 and earlier → 10.13.1190+
• 10.10.1180 and earlier → 10.10.1181+

Note: Version 10.10.1181 has reached End of Maintenance (EOM) and only receives fixes for internally discovered critical issues.

Additional Vulnerabilities

HPE’s bulletin also disclosed 23 other flaws, several rated high severity (CVSS 8.1–8.8). Examples include:

• CVE‑2026‑73750: Malformed input causing DoS or code execution.
• CVE‑2026‑73751: Arbitrary command execution via web management interface.
• CVE‑2026‑73752: File write via API endpoint leading to RCE.
• CVE‑2026‑73778: Exploitation of predictable factory‑default passwords for full admin control.
• CVE‑2026‑73781: Stored XSS in web management interface.

Exploitation Status

• HPE states there is no evidence of active exploitation or public proof‑of‑concept exploits at the time of publication.
• However, given the critical nature of CVE‑2026‑73749 and the widespread use of ArubaOS‑CX, organizations are strongly urged to patch immediately.

Defensive Guidance

Organizations should:

• Upgrade immediately to patched releases.
• Audit configurations for weak or default credentials.
• Restrict management access to trusted networks.
• Monitor logs for malformed packet activity.
• Apply layered defenses including intrusion detection and segmentation.

Expert in the Cloud Insight

This disclosure highlights the critical role of network operating systems in enterprise security. ArubaOS‑CX vulnerabilities can provide attackers with privileged access to core infrastructure, making timely patching and configuration hardening non‑negotiable. The lesson is clear: network switches are not just hardware—they are software platforms that must be secured with the same urgency as servers and endpoints.