HPE Patches Critical Remote Code Execution Vulnerability in ArubaOS-CX

Hewlett Packard Enterprise (HPE) has released fixes for a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote execution of arbitrary code.

The issue, assigned the identifier CVE-2026-73749, is a buffer overflow. An unauthenticated remote attacker can send specially crafted packets to a vulnerable daemon and achieve code execution with elevated privileges. HPE's advisory notes that “there are multiple vulnerabilities in the ArubaOS-CX daemon that allow for improper handling of malformed input.”

Affected versions

The release branches affected by the vulnerabilities and the recommended updates:

• 10.18.0001 → 10.18.1002 and later;
• 10.17.1021 and earlier → 10.17.1030 and later;
• 10.16.1051 and earlier → 10.16.1060 and later;
• 10.13.1180 and earlier → 10.13.1190 and later;
• 10.10.1180 and earlier → 10.10.1181 and later.

Version 10.10.1181 has already reached End of Maintenance and receives fixes only for critical issues discovered internally at the company — a category that CVE-2026-73749 also falls under.

ArubaOS-CX is used in HPE Aruba Networking enterprise network switches. They are deployed by large businesses, government agencies, universities, healthcare organizations, data centers and service providers, which makes the scale of potential impact significant.

Another 23 vulnerabilities

Beyond the main flaw, the advisory covers a set of 23 other vulnerabilities, some of which are rated high severity with scores ranging from 8.1 to 8.8. These include arbitrary command execution through the web management interface, arbitrary file writes via an API endpoint accessible from an adjacent network, authentication bypass on switches, and a format string in the command line that allows code execution with privileges.

CVE-2026-73778 deserves particular attention: an unauthenticated attacker can exploit a predictable factory password to gain full administrative control over a device that remains in its factory-default state or has just completed the ZTP procedure — before an administrator sets their own credentials.

HPE “strongly recommends” that customers upgrade to one of the fixed releases. As of the advisory's publication, the vendor was not aware of any cases of active exploitation or any publicly available proof-of-concept for the listed vulnerabilities.

Source: Bleeping Computer