Unauthenticated Remote Code Execution in HPE Aruba Networking AOS

HPE Aruba Networking has disclosed multiple critical vulnerabilities in the AOS-CX switch operating system, tracked as CVE-2026-73749, carrying an NVD CVSS base score of 9.8 (Critical). An unauthenticated remote attacker can send specially crafted packets to an affected daemon and achieve remote code execution with elevated privileges, requiring no credentials, user interaction, or special network position. Organizations running AOS-CX switches should treat this as a priority remediation item, as successful exploitation would give an attacker full control over network switching infrastructure.