HPE Patches Critical ArubaOS-CX Flaw Enabling Unauthenticated Remote Code Execution
Summary
HPE patched critical ArubaOS-CX flaw CVE-2026-73749, which could let unauthenticated remote attackers execute code with elevated privileges, and addressed 23 other vulnerabilities. HPE urges customers to upgrade; it reported no known exploitation or public proof of-con
Key points
- CVE-2026-73749 is a critical buffer overflow that could allow unauthenticated remote code execution with elevated privileges via specially crafted packets.
- HPE's bulletin covers 23 additional ArubaOS-CX vulnerabilities, including flaws that could enable command execution, authentication bypass, file writing, or denial of service.
- HPE listed fixed releases across branches 10.18, 10.17, 10.16, 10.13, and 10.10; customers are urged to upgrade.
- HPE said it was not aware of active exploitation or publicly available proof-of-concept exploits for the listed flaws at bulletin publication.
- HPE notes that ArubaOS-CX 10.10.1181 is at End of Maintenance and receives fixes only for internally discovered critical issues.
Article Details
- Vulnerability Types
- Buffer overflow
- Format-string vulnerability
- Stored cross-site scripting
- Missing CSRF protections
- Authentication bypass
- Predictable factory-default password
- Severity
- Critical
- Affected Versions
- ArubaOS-CX 10.18.0001
- ArubaOS-CX 10.17.1021 and earlier
- ArubaOS-CX 10.16.1051 and earlier
- ArubaOS-CX 10.13.1180 and earlier
- ArubaOS-CX 10.10.1180 and earlier
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
CVE
CVE-2026-73749Hewlett Packard Enterprise has patched CVE-2026-73749, a critical buffer overflow in ArubaOS-CX that could let unauthenticated remote attackers achieve code execution with elevated privileges.CVE-2026-73750CVE-2026-73750: A low-privileged authenticated remote attacker can send malformed or truncated input to an AOS-CX management module, potentially causing denial of service or executing code with elevated privileges.CVE-2026-73751CVE-2026-73751: A low-privileged authenticated user can submit crafted input through the AOS-CX web-based management interface to execute arbitrary commands on the underlying operating system.CVE-2026-73752CVE-2026-73752: An unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.CVE-2026-73753CVE-2026-73753: A low-privileged authenticated user can exploit affected AOS-CX command-line operations to execute arbitrary commands as a privileged user on the underlying operating system.CVE-2026-73777CVE-2026-73777: An unauthenticated remote attacker can exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges.CVE-2026-73778CVE-2026-73778: An unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of an AOS-CX device that remains in its factory-default or post-ZTP state before anCVE-2026-73779CVE-2026-73779: An unauthenticated attacker with adjacent-network access can bypass authentication controls on AOS-CX switches, potentially exposing sensitive information, enabling unauthorized modifications, andCVE-2026-73780CVE-2026-73780: An unauthenticated remote attacker can exploit missing CSRF protections in some certificate-authenticated AOS-CX sessions to submit arbitrary input to the web-based management interface by convincing anCVE-2026-73781CVE-2026-73781: An authenticated remote attacker can exploit a stored cross-site scripting vulnerability in the AOS-CX web-based management interface to execute arbitrary scripts in an administrator’s browser if theCVE-2026-73782CVE-2026-73782: An unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX command-line interface to execute arbitrary code as a privileged user on the underlying
Vendors
Products
Industries
Data centersorganizations such as large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.GovernmentArubaOS-CX flaws affecting enterprise network switches used by organizations such as large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.Healthcarenetwork switches used by organizations such as large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.Service providersas large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.