HPE Patches Critical RCE Vulnerabilities in AOS

Hewlett Packard Enterprise (HPE) has released patches for 34 CVEs in the Aruba Networking ArubaOS-CX (AOS-CX) platform, including critical-severity remote code execution (RCE) flaws.

Per HPT’s advisory , more than 150 flaws were resolved in AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181. Many of these bugs are tracked together under single CVEs.

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

The critical security defects are rooted in the improper processing of malformed input sent to an unnamed service within HPE’s database-centric operating system for enterprise switches.

According to the company, an unauthenticated attacker could exploit the security defects by sending crafted packets to the vulnerable service, achieving RCE with elevated privileges.

The fresh updates also resolve 22 high-severity CVEs that could lead to denial-of-service (DoS), RCE, arbitrary command execution, arbitrary script code execution in a victim’s browser, authentication bypass, privilege escalation, and information disclosure.

All the remaining 11 CVEs are medium-severity flaws leading to access controls bypass, information disclosure, arbitrary file reads, DoS, and privilege escalation.

HPE says the majority of these vulnerabilities were discovered internally by its security team, noting that it is not aware of any of them being exploited in the wild.

“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage,” the company notes.

Related: Sangoma Switchvox Vulnerabilities Exploited in the Wild

Related: VMware Workstation and Fusion Updates Patch Critical Vulnerability

Related: Capsule Security Launches ‘AI Circuit Breaker’ to Stop Rogue Agents

Related: Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

HiddenLayer Raises $100 Million for AI Runtime Security

153 Million Driver License Images Offered on Dark Web

Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

Exploit Published for Fresh Cleo Harmony Vulnerability

Malicious Virtualizor Update Served via BGP Hijacking

Chrome and Firefox Updates Patch Dozens of Vulnerabilities

In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation

OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders

Sangoma Switchvox Vulnerabilities Exploited in the Wild

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

Catch Raises $5 Million for AI Executive Assistant With Guardrails

VMware Workstation and Fusion Updates Patch Critical Vulnerability

Google Patches 6th Chrome Zero-Day of 2026

Nvidia Is Buying AI Platform Hugging Face for $13 Billion

Virtual Event: Attack Surface Management Summit 2026

Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.

Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover?

In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.

Flipboard Whatsapp Whatsapp Email