HPE Patches Critical Remote Code Execution Flaws in ArubaOS-CX
Summary
HPE patched 34 CVEs in ArubaOS-CX, including critical flaws that could let unauthenticated attackers execute code with elevated privileges. The company says it is unaware of exploitation and recommends restricting management interfaces.
Key points
- HPE released updates for ArubaOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181.
- The advisory covers 34 CVEs, with more than 150 flaws resolved; multiple flaws are grouped under single CVE identifiers.
- Nearly two dozen issues are tracked as CVE-2026-73749, rated CVSS 9.8. Crafted packets sent to an unnamed service could reportedly enable unauthenticated remote code execution with elevated privileges.
- Other addressed flaws could cause denial of service, command or script execution, authentication bypass, privilege escalation, and information disclosure.
- HPE says most vulnerabilities were found internally and that it is unaware of exploitation in the wild.
- HPE recommends restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN, or controlling access with firewall policies, and using accounting controls to track and log activity.
Article Details
- Vulnerability Types
- Remote code execution
- Denial of service
- Arbitrary command execution
- Arbitrary script code execution in a victim’s browser
- Authentication bypass
- Privilege escalation
- Information disclosure
- Access control bypass
- Arbitrary file read
- Severity
- Critical, high, and medium severity vulnerabilities are reported; CVE-2026-73749 is rated CVSS 9.8.
- Affected Versions
- ArubaOS-CX 10.18.1002
- ArubaOS-CX 10.17.1030
- ArubaOS-CX 10.16.1060
- ArubaOS-CX 10.13.1190
- ArubaOS-CX 10.10.1181
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.