HPE Patches Critical Remote Code Execution Vulnerability in ArubaOS-CX

The buffer overflow flaw, tracked as CVE-2026-73749, allows unauthenticated attackers to execute code with elevated privileges; 23 other vulnerabilities also addressed.

edit

By LineZotpaper

Published4 September 2026

Read Time2 min

Hewlett Packard Enterprise (HPE) has released security updates to address a critical buffer overflow vulnerability in its ArubaOS-CX network operating system that could allow unauthenticated remote attackers to achieve code execution with elevated privileges. The flaw, designated CVE-2026-73749, is among 24 vulnerabilities disclosed in a bulletin this week, with several others rated high severity.

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution by unauthenticated attackers.

The issue, tracked as CVE-2026-73749, is a buffer overflow that allows an unauthenticated remote attacker to send specially crafted packets to an affected daemon process, achieving code execution with elevated privileges.

"Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input," HPE's security bulletin states. "An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service."

Affected release branches and the corresponding fixed versions are:

10.18.0001 → upgrade to 10.18.1002+
10.17.1021 and earlier → 10.17.1030+
10.16.1051 and earlier → 10.16.1060+
10.13.1180 and earlier → 10.13.1190+
10.10.1180 and earlier → 10.10.1181+

HPE noted that version 10.10.1181 has reached End of Maintenance and only receives fixes for internally discovered critical issues, a condition that also applies to CVE-2026-73749.

ArubaOS-CX is the operating system for HPE Aruba Networking's enterprise-grade network switches, typically used by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.

The bulletin also covers 23 other security vulnerabilities, some with high severity ratings between 8.1 and 8.8. These include flaws that could allow low-privileged authenticated attackers to execute code or cause denial of service (CVE-2026-73750), execute arbitrary commands via the web-based management interface (CVE-2026-73751), write arbitrary files to gain remote code execution (CVE-2026-73752), and execute commands as a privileged user (CVE-2026-73753). Other vulnerabilities involve format-string flaws, stored cross-site scripting, missing CSRF protections, and authentication bypasses.

HPE urges administrators using affected versions to apply the appropriate updates as soon as possible.

Analysis

Why This Matters

Organizations relying on ArubaOS-CX switches face potential unauthenticated remote compromise if patches are not applied promptly.
The critical (CVE-2026-73749) and high-severity flaws cover multiple attack vectors—from network-based exploitation to authenticated privilege escalation—broadening the risk surface.
End-of-maintenance status for some versions means users on older branches may have limited support for future fixes, increasing urgency to upgrade to supported releases.

Background

ArubaOS-CX is a network operating system used in HPE Aruba Networking's enterprise switches. It is deployed by large organizations, including government, education, healthcare, and data centers. Buffer overflow vulnerabilities in network daemons are a common but dangerous class of flaws, as they often allow remote code execution without authentication. Security patches for such critical issues are typically released as soon as fixes are verified.

Key Perspectives

HPE (Vendor): HPE has issued patches and a detailed advisory urging prompt updates. The company notes that older version branches reaching End of Maintenance will only receive fixes for internally discovered critical issues, shifting responsibility onto administrators to keep systems current. Affected Organizations (IT Administrators): Network operations teams must prioritize patching vulnerable switches, but may face downtime planning and compatibility testing. Users on EOM branches have a stronger incentive to migrate to supported versions to continue receiving security updates. Security Researchers: The disclosure of 24 vulnerabilities—including multiple unauthenticated code execution paths—highlights the complexity of securing modern network operating systems and the importance of rigorous input validation in daemon processes.

What to Watch

Whether any proof-of-concept exploits or in-the-wild attacks targeting CVE-2026-73749 emerge in the coming weeks.
Adoption rates of the new firmware versions among large ArubaOS-CX deployments.
HPE's future support decisions for aging release branches as End of Maintenance dates approach.
Potential follow-up patches if additional related vulnerabilities are discovered during further code review.

Sources

HPE patches critical ArubaOS-CX remote code execution flaw — BleepingComputer