HPE Patches ArubaOS-CX: Two Independent No

HPE Aruba Networking published a security bulletin on September 1, 2026 patching 24 vulnerabilities in ArubaOS-CX — the operating system running its CX-series enterprise switches — and the risk profile goes beyond the headline critical flaw. Two of the disclosed vulnerabilities independently allow an unauthenticated attacker to achieve full remote code execution on a targeted switch with no credentials and no user interaction required, meaning an adversary who cannot exploit one path may succeed through the other.

The compound nature of this disclosure — two simultaneous, technically distinct unauthenticated code-execution paths in the same operating system — is what separates this bulletin from a standard critical-CVE patch and demands immediate administrative action in any environment running ArubaOS-CX switches.

What the Critical Flaw Actually Is

The headline vulnerability, tracked as CVE-2026-73749 and carrying a CVSS score of 9.8 out of 10, is a buffer overflow in a daemon process of ArubaOS-CX. A buffer overflow — classified under CWE-120, Buffer Copy without Checking Size of Input — occurs when a program copies incoming data into a fixed-size memory region without first checking whether the data fits. When an attacker sends more data than the buffer can hold, the excess overwrites adjacent memory, which can include function return addresses and control-flow pointers. By crafting that overflow data precisely, an attacker can redirect the daemon's execution to attacker-supplied code.

In concrete terms: any network-reachable attacker — one with access to the segment or subnet where the switch's affected service is exposed — can send a single specially crafted packet to trigger the overflow and gain elevated code execution on the switch's underlying hardware. No account. No password. No victim required to take any action.

HPE confirmed the attack profile in its own bulletin: the bulletin states that "An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service."

A CVSS score of 9.8 is, for practical purposes, the highest achievable severity for a network-facing vulnerability. Every access barrier — authentication, user interaction, attack complexity — is absent. Any attacker with network-layer reach to the service can attempt exploitation.

A Second Unauthenticated Code-Execution Path

The second independently dangerous flaw is CVE-2026-73782, a format-string vulnerability in the ArubaOS-CX command-line interface, carrying a high CVSS score. Unlike a buffer overflow, a format-string bug occurs when a program passes user-controlled data directly as a format argument to a function like printf — allowing an attacker who controls that data to inject format specifiers that write arbitrary values to arbitrary memory locations. The result is the same: unauthenticated remote code execution with elevated privileges.

Where CVE-2026-73749 exploits a daemon's failure to check input size, CVE-2026-73782 exploits the CLI's failure to sanitize data before using it as a format template. They are different engineering failures, in different code components, exploitable by different means. An organization whose compensating controls happen to block the daemon's service port while leaving the CLI accessible faces exposure from CVE-2026-73782. An organization that restricts CLI access but not the daemon's port remains exposed to CVE-2026-73749.

The presence of two simultaneous unauthenticated RCE paths in the same bulletin is not merely additive risk — it signals broader code-quality concerns in the OS and should factor into how urgently administrators treat the patch cycle.

Who Uses ArubaOS-CX and What Is at Stake

ArubaOS-CX is HPE Aruba Networking's flagship operating system for its CX-series enterprise switches — hardware typically deployed at the core and distribution layers of large-scale networks, where it routes traffic for the entire organization rather than for individual endpoints. Affected organizations span every major sector: large enterprises, government agencies, universities, healthcare providers, data centers, and telecommunications service providers.

This matters for the threat calculus because core network infrastructure occupies a uniquely privileged position. A threat actor who compromises a core switch does not need to breach individual endpoints — they can intercept, redirect, and manipulate traffic organization-wide from a single vantage point. That position also survives endpoint remediation: reimaging servers and rotating credentials does not dislodge an adversary who controls the switch their traffic flows through.

Nation-state advanced persistent threat groups have already established a pattern of targeting enterprise network appliances for precisely this reason. State- actors including Volt Typhoon and Salt Typhoon have been documented exploiting unpatched vulnerabilities in network infrastructure to breach critical infrastructure and telecommunications providers, converting compromised network devices into persistent footholds that can remain undetected for years.

The Full Bulletin: 24 Vulnerabilities, Multiple Attack Classes

Beyond the two unauthenticated RCE paths, HPE's full security bulletin addresses 22 additional vulnerabilities in ArubaOS-CX. Several carry high CVSS scores between 8.1 and 8.8, spanning a range of attack classes.

CVE-2026-73778 is among the most immediately actionable: an unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of any AOS-CX device still running its factory-default or post-zero-touch-provisioning credentials. Any device that was deployed and never had its credentials changed is fully controllable by anyone who knows the factory default. Administrators should audit every switch in their fleet for this condition, regardless of whether they can patch immediately.

CVE-2026-73779 allows an unauthenticated adjacent-network attacker to bypass authentication controls entirely, potentially exposing sensitive information, enabling unauthorized configuration changes, and disrupting services.

CVE-2026-73777 allows an unauthenticated remote attacker to bypass access controls and escalate privileges through vulnerabilities in an AOS-CX API endpoint.

CVE-2026-73752 allows an unauthenticated adjacent-network attacker to write arbitrary files to the underlying operating system through an AOS-CX API endpoint — a path that could enable persistent backdoor installation.

Lower-severity but still significant authenticated flaws include CVE-2026-73751 (low-privileged user can execute arbitrary OS commands through the web management interface), CVE-2026-73753 (low-privileged user can escalate to privileged command execution via the CLI), CVE-2026-73750 (low-privileged user can trigger denial of service or elevated code execution via a management module), and CVE-2026-73781 (stored XSS enabling arbitrary script execution in an administrator's browser). CVE-2026-73780 allows a CSRF attack against certificate-authenticated sessions, letting an unauthenticated attacker submit arbitrary input to the management interface by tricking an authenticated administrator into loading a crafted URL.

Which ArubaOS-CX Versions Are Affected — and What to Patch To

HPE's bulletin identifies five affected release branches and their corresponding remediated versions:

10.17.1021 and earlier

10.16.1051 and earlier

10.13.1180 and earlier

10.10.1180 and earlier

Organizations running the 10.10.x branch face an added complication: that branch has reached End of Maintenance (EOM), meaning HPE provides fixes only for internally discovered, critical-severity issues. CVE-2026-73749 met that threshold and received a patch. However, any future critical vulnerability — including any of the 22 non-headline CVEs in this bulletin that fall below the EOM threshold — may not be patched on 10.10.x. Administrators on this branch should treat the patch as urgent while also treating this bulletin as a forcing function for migration to a currently maintained release track.

Why the Patch Window Is Narrow

HPE confirmed at the time of publication that it was not aware of any active exploitation in the wild or any publicly available proof-of-concept exploit code targeting the disclosed flaws. That window is typically narrow for critical network infrastructure vulnerabilities. The combination of a 9.8 CVSS score, a no-credentials, no-user-interaction attack requirement, and a widely deployed enterprise product makes CVE-2026-73749 a high-priority target for both automated scanning and targeted campaigns by well-resourced threat actors.

The InfraTrust infrastructure security report published in July 2026 documented that in recent SonicWall exploitations, attackers had weaponized network appliance exploits weeks before those vulnerabilities were publicly disclosed — meaning the post-disclosure window for unpatched organizations may be shorter than historical averages suggest.

What Administrators Should Do Now

HPE "strongly encourages" customers to upgrade to one of the patched firmware releases as soon as possible. For environments where immediate patching is not feasible, security teams should implement the following compensating controls:

Restrict management-plane access. Limit access to switch management interfaces, CLI services, and control-plane services to a dedicated out-of-band management network or to specific trusted administrator IP addresses enforced through control-plane access control lists. This does not eliminate exposure to CVE-2026-73749 — which targets a daemon service, not just the management interface — but raises the bar for exploitation significantly.

Audit factory-default credentials immediately. CVE-2026-73778 requires only knowledge of the factory-default password. Any switch still carrying its factory-default or post-zero-touch-provisioning credentials is fully controlled by anyone who attempts it. This audit does not require patching and should happen immediately.

Review switch configurations for unauthorized changes. Following the bulletin's disclosure, administrators should compare current ACLs, VLAN assignments, static routes, and local account lists against approved configuration baselines. Anomalies may indicate prior compromise.

Forward switch logs to a SIEM. Centralized log collection enables detection of anomalous traffic patterns, authentication events, and configuration changes that may indicate exploitation attempts.

Plan asymmetric patch cycles for VSX environments. ArubaOS-CX patches require a switch reboot. In VSX (Virtual Switching Extension) high-availability deployments, HPE recommends upgrading nodes one at a time — asymmetrically — so that network continuity is preserved. This means one VSX node will be unpatched while the other undergoes the upgrade. Administrators should minimize this exposure window by sequencing upgrades immediately and maintaining especially tight access controls on the unpatched node during the transition.

Migrate off EOM branches. Organizations running AOS-CX 10.10.x should use this bulletin as the prompt — not merely to apply the available patch, but to commit to a migration timeline for moving to a fully maintained release track before the critical vulnerability arrives without a fix.

Frequently Asked Questions

What is CVE-2026-73749 and why is it rated 9.8 Critical?

CVE-2026-73749 is a buffer overflow in a daemon process of ArubaOS-CX, the operating system running HPE Aruba CX-series enterprise switches. The 9.8 CVSS score reflects the worst-case combination of attack conditions: the vulnerability is exploitable over the network, requires no authentication, demands no user interaction, and enables full remote code execution with elevated privileges on the affected switch. There is no practical access barrier between an attacker with network-layer reach and a successful exploit.

What does it mean that two separate unauthenticated RCE vulnerabilities exist in the same bulletin?

CVE-2026-73749 (a buffer overflow in a daemon) and CVE-2026-73782 (a format-string bug in the CLI) are distinct engineering failures in different code components. They cannot be addressed by a single compensating control. An attacker blocked from one path by network segmentation may succeed through the other. The co-occurrence of two independent unauthenticated RCE paths in a single patch cycle is unusual and suggests that the underlying codebase warrants a thorough security review beyond the specific CVEs addressed in this bulletin.

Is my HPE ArubaOS-CX switch affected if it runs firmware 10.10.x?

Yes — the 10.10.x branch is listed as affected, and HPE has released version 10.10.1181 as a patch for CVE-2026-73749 specifically because it met the End of Maintenance threshold for internal-critical-only fixes. However, the 10.10.x branch is otherwise at EOM, meaning most of the 22 other vulnerabilities in this bulletin will not receive patches on that branch. Administrators should apply 10.10.1181 immediately to address CVE-2026-73749, then treat the migration off the 10.10.x branch as a near-term operational priority.

What is the single most urgent action for administrators right now?

Audit every ArubaOS-CX switch for factory-default credentials (CVE-2026-73778) today — this requires no patch and can be completed immediately. Then prioritize firmware upgrades to the patched versions listed in HPE bulletin HPESBNW05134. Concurrently, restrict management-plane access to out-of-band networks or trusted IPs to reduce the exposure window while patching is scheduled.