HPE patches critical unauthenticated RCE in ArubaOS-CX switches

HPE Networking has patched CVE-2026-73749, a critical unauthenticated remote code execution flaw in ArubaOS-CX. The fix shipped on 1 September 2026 in security advisory HPESBNW05134. The CVE covers multiple buffer overflow bugs in a single AOS-CX daemon that mishandles malformed input.

An attacker who can reach the affected service sends specially crafted packets and, on success, runs code with elevated privileges. HPE scores it 9.8 under CVSS v3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No credentials, no user interaction, low attack complexity.

CVE-2026-73749 is not alone. Per HPE's own reference list, the same bulletin covers 34 CVEs: one critical, 22 high and 11 medium.

A compromised switch is not just one more compromised host. AOS-CX runs access, aggregation and data center switches that carry everything else, so code execution there sits underneath most of the controls a security team relies on.

From that position an attacker can mirror or redirect traffic, weaken ACLs, collapse VLAN segmentation and hold access after servers get rebuilt. Switch operating systems also rarely run endpoint detection, so investigation falls back to syslog, crash records and configuration diffs.

HPE found these bugs through internal security research and states it saw no public exploit code at release. That is the useful window. It tends to close once a patch gives researchers something to compare against.

The advisory scopes exposure by software branch, not by switch model. Affected releases are AOS-CX 10.18.0001, 10.17.1021 and below, 10.16.1051 and below, 10.13.1180 and below, and 10.10.1180 and below.

HPE adds two caveats worth reading. Releases past End of Maintenance are presumed affected unless stated otherwise, and HPE has not assessed exposure for anything past End of Support. If you run an unsupported image, treat it as vulnerable until proven otherwise.

BleepingComputer, reporting on 3 September 2026, notes that AOS-CX is common in large businesses, government agencies, universities, healthcare organisations, data centers and service providers. Check the running image on each device, not the branch you believe you standardised on.

HPE describes CVE-2026-73749 as multiple vulnerabilities in one AOS-CX daemon that improperly processes malformed input. The bulletin groups 19 internal findings under that single CVE, which is why one identifier carries so much weight here.

The advisory does not name the daemon, the protocol or the port. That gap matters. Without it you cannot write a targeted detection or confirm exposure from a scan, so reachability assumptions have to stay conservative.

Several other unauthenticated paths sit just under the headline. CVE-2026-73752 is an arbitrary file write in an API endpoint that can lead to RCE, and CVE-2026-73782 is a format string bug in the CLI, both rated 8.8 from an adjacent network. CVE-2026-73778 covers a predictable factory default password in Credential Manager, exploitable while a device is still in its factory or post-ZTP state before an administrator sets credentials.

Authentication and authorisation bypasses round out the unauthenticated set, with CVE-2026-73779 at 8.2 and CVE-2026-73777 at 8.1. The authenticated bugs are no formality either: CVE-2026-73750, CVE-2026-73751 and CVE-2026-73753 all reach 8.8 and all end in command or code execution on the underlying OS.

HPE published the advisory as FINAL at revision 1 and rates the overall bulletin critical. Fixed builds are listed per branch, and images come from the HPE Networking Support Portal.

10.18.0001            ->  10.18.1002 and above
10.17.1021 and below  ->  10.17.1030 and above
10.16.1051 and below  ->  10.16.1060 and above
10.13.1180 and below  ->  10.13.1190 and above
10.10.1180 and below  ->  10.10.1181 and above  (EOM)

The 10.10.x caveat deserves a second read. It is an End of Maintenance branch, and HPE addressed only internally identified critical issues there. So 10.10.1181 fixes CVE-2026-73749 and leaves other CVEs from the same bulletin open.

Credit is mostly internal. Two findings came through HPE Networking's bug bounty program: BUND for CVE-2026-73773 and a researcher listed as Haxship1337 for CVE-2026-73755.

Patch first. Map each switch to its branch, then upgrade to the fixed release for that branch. Prioritise anything whose management plane or affected service can be reached from user VLANs, partner links or the internet.

HPE's documented workaround is to restrict the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, or to control them with firewall policies at layer 3 and above, alongside accounting controls that log user activity and resource usage.

If you run 10.10.x, put the migration to a maintained branch in the same change window. Otherwise you will read the next bulletin from the same position.

Watch for a CISA KEV listing or a public proof of concept. Network gear with a no-credentials, no-interaction path attracts scanning quickly once technical details surface, and this advisory is deliberately vague about the affected service.

On your own estate, pull crash and reboot records for affected switches, review configuration diffs and administrative logins on your management platform, and flag any switch contacting destinations it has no reason to reach. None of that confirms exploitation on its own. A crash is just a crash until something else lines up with it.

A revision 2 of the bulletin is also worth watching. HPE grouped many findings under single identifiers, and the detail in these advisories often grows after publication.