“Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input,” HPE warned in its bulletin. The vendor says one of those flaws is a critical, unauthenticated buffer overflow that can lead to remote code execution with elevated privileges.
CVE-2026-73749: unauthenticated buffer overflow in an ArubaOS-CX daemon
Tracked as CVE-2026-73749, HPE describes the issue as a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process and achieve code execution with elevated privileges. The bulletin frames the problem succinctly: “An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service.”
Affected release branches and the vendor's fixes
HPE listed the affected release branches and the corresponding fixed releases that customers should move to:
- 10.18.0001 → upgrade to 10.18.1002+
- 10.17.1021 and earlier → 10.17.1030+
- 10.16.1051 and earlier → 10.16.1060+
- 10.13.1180 and earlier → 10.13.1190+
- 10.10.1180 and earlier → 10.10.1181+
HPE also noted that AOS-CX 10.10.1181 has reached End of Maintenance (EOM) and “only receives fixes for internally discovered, critical issues,” a condition the vendor said also applies to CVE-2026-73749. The vendor “strongly encourages” customers to upgrade to one of the fixed releases listed in the bulletin.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTwenty-three additional vulnerabilities disclosed in the bulletin
Alongside CVE-2026-73749, HPE’s bulletin covers a set of 23 other vulnerabilities — some carrying high severity ratings between 8.1 and 8.8 — that affect AOS-CX. The vendor’s summary includes the following examples:
- CVE-2026-73750: A low-privileged authenticated remote attacker can send malformed or truncated input to an AOS-CX management module, potentially causing denial of service or executing code with elevated privileges.
- CVE-2026-73751: A low-privileged authenticated user can submit crafted input through the AOS-CX web-based management interface to execute arbitrary commands on the underlying operating system.
- CVE-2026-73752: An unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.
- CVE-2026-73753: A low-privileged authenticated user can exploit affected AOS-CX command-line operations to execute arbitrary commands as a privileged user on the underlying operating system.
- CVE-2026-73782: An unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX command-line interface to execute arbitrary code as a privileged user on the underlying operating system.
- CVE-2026-73781: An authenticated remote attacker can exploit a stored cross-site scripting vulnerability in the AOS-CX web-based management interface to execute arbitrary scripts in an administrator’s browser if the administrator interacts with the affected content.
- CVE-2026-73780: An unauthenticated remote attacker can exploit missing CSRF protections in some certificate-authenticated AOS-CX sessions to submit arbitrary input to the web-based management interface by convincing an authenticated user to open a crafted URL.
- CVE-2026-73779: An unauthenticated attacker with adjacent-network access can bypass authentication controls on AOS-CX switches, potentially exposing sensitive information, enabling unauthorized modifications, and disrupting services.
- CVE-2026-73778: An unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of an AOS-CX device that remains in its factory-default or post-ZTP state before an administrator configures credentials.
- CVE-2026-73777: An unauthenticated remote attacker can exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges.
How large organizations, administrators, and potential adversaries are affected
ArubaOS-CX is HPE Aruba Networking’s operating system for enterprise-grade network switches and is typically used by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers. For operators of those environments, HPE’s bulletin implies immediate patch management decisions: the vendor’s published fixed releases identify concrete upgrade paths.
Network administrators must account for devices in factory-default or post-ZTP states because CVE-2026-73778 describes a predictable factory-default password that can be used to obtain full administrative control prior to administrator configuration. Administrators should also note the EOM status of 10.10.1181 and that it receives only limited critical fixes, per the bulletin.
HPE stated that, at the time of the bulletin’s publication, it was not aware of active exploitation or publicly available proof-of-concept exploits targeting the listed flaws.
Defensive measurement note: the Blue Report 2026
HPE’s bulletin includes a short contextual note on defensive measurement: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026, the vendor says, “measures defenses technique by technique across 338 million simulations run in customer production environments.”
HPE’s practical instruction is straightforward in the bulletin: upgrade to the listed fixed releases. The combination of an unauthenticated remote-code-execution flaw and a set of additional high-severity issues — including authentication bypasses, factory-default password weaknesses, and API and web-interface weaknesses — places ArubaOS-CX operators squarely on the clock to apply the fixes HPE has provided.
