HPE Patches Critical ArubaOS-CX Remote Code Execution Vulnerability

Hewlett Packard Enterprise (HPE) has released security updates for a critical vulnerability in its ArubaOS-CX network operating system that could allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges.

Tracked as CVE-2026-73749, the flaw is a buffer overflow vulnerability in an ArubaOS-CX daemon. An attacker could exploit the issue by sending specially crafted network packets to an affected service, potentially gaining remote code execution on vulnerable HPE Aruba Networking switches.

HPE said that multiple vulnerabilities in the ArubaOS-CX daemon could cause malformed input to be handled improperly. Read HPE’s security bulletin.

According to HPE, an unauthenticated remote attacker could exploit the vulnerabilities by sending specially crafted packets to an affected service.

ArubaOS-CX versions affected and fixed

HPE recommends upgrading affected ArubaOS-CX installations to one of the following fixed releases:

• 10.18.0001 and earlier → 10.18.1002 or later
• 10.17.1021 and earlier → 10.17.1030 or later
• 10.16.1051 and earlier → 10.16.1060 or later
• 10.13.1180 and earlier → 10.13.1190 or later
• 10.10.1180 and earlier → 10.10.1181 or later

HPE noted that ArubaOS-CX 10.10.1181 has reached end of maintenance (EOM). As a result, the release will only receive patches for critical vulnerabilities discovered internally. This limitation also applies to CVE-2026-73749.

ArubaOS-CX powers HPE Aruba Networking’s enterprise switches. The platform is commonly deployed by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.

Additional ArubaOS-CX security vulnerabilities

HPE’s security bulletin also addresses 23 other vulnerabilities, including several flaws with severity ratings ranging from 8.1 to 8.8. The vulnerabilities described in the bulletin include:

• CVE-2026-73750: An authenticated remote attacker with low-level privileges could send malformed or truncated input to the ArubaOS-CX management module, potentially causing a denial-of-service condition or executing code with elevated privileges.
• CVE-2026-73751: An authenticated low-privileged user could submit specially crafted input through the ArubaOS-CX web management interface to execute arbitrary commands on the underlying operating system.
• CVE-2026-73752: An unauthenticated attacker with access to an adjacent network could exploit an ArubaOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.
• CVE-2026-73753: An authenticated low-privileged user could abuse affected ArubaOS-CX command-line operations to execute arbitrary commands as a privileged operating system user.
• CVE-2026-73782: An unauthenticated attacker with access to an adjacent network could exploit a format-string vulnerability in the ArubaOS-CX command-line interface to execute arbitrary code with privileged access.
• CVE-2026-73781: An authenticated remote attacker could exploit stored cross-site scripting in the ArubaOS-CX web management interface to run arbitrary scripts in an administrator’s browser when the administrator views affected content.
• CVE-2026-73780: An unauthenticated remote attacker could exploit missing cross-site request forgery protections in a certificate-authenticated ArubaOS-CX session. The attacker could submit arbitrary requests by tricking an authenticated user into opening a specially crafted URL.
• CVE-2026-73779: An unauthenticated attacker with access to an adjacent network could bypass ArubaOS-CX authentication controls, access sensitive information, make unauthorized configuration changes, and potentially disrupt services.
• CVE-2026-73778: An unauthenticated remote attacker could use a predictable factory-default password to gain full administrative control of an ArubaOS-CX switch that remains in its factory-default or post-ZTP state before credentials are configured.
• CVE-2026-73777: A vulnerability in an ArubaOS-CX API endpoint could allow an unauthenticated remote attacker to bypass access controls and escalate privileges.

HPE strongly recommends that customers upgrade ArubaOS-CX devices to one of the fixed releases listed in the security bulletin. Administrators should also review their switch configurations, restrict management access, and ensure that default credentials are changed before devices are placed into production.

HPE said it was not aware of active exploitation of the vulnerabilities or publicly available proof-of-concept exploits when the security bulletin was published.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report