Critical RCE Vulnerabilities in HPE ArubaOS-CX Require Immediate Patching

• •HPE patched 35 vulnerabilities in ArubaOS-CX, including two critical RCE flaws.
• •CVE-2026-73749 and CVE-2026-73782 allow unauthenticated remote code execution.
• •Immediate patching is recommended as no active exploitation has been confirmed yet.

Hewlett Packard Enterprise (HPE) has patched 35 vulnerabilities in its ArubaOS-CX network operating system, including two critical remote code execution (RCE) flaws tracked as CVE-2026-73749 and CVE-2026-73782. The first vulnerability, a buffer overflow, allows unauthenticated attackers to execute arbitrary code by sending specially crafted packets to the affected service, achieving a CVSS score of 9.8. The second flaw, a format-string vulnerability, also permits unauthenticated remote code execution. HPE's advisory indicates that these vulnerabilities could impact enterprise switches widely used in various sectors, including government and healthcare. Although there are no confirmed instances of exploitation, security experts urge immediate patching to mitigate potential risks. The vulnerabilities were disclosed in a security bulletin on September 1, 2026, and affect multiple versions of ArubaOS-CX. Organizations are advised to restrict access to the management interfaces and apply the patches promptly.