Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. Tracked as CVE-2026-73749, the security issue is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process, achieving code execution with elevated privileges. “Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input,” reads HPE’s bulletin. “An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service.” Affected release branches and fixes listed in the bulletin are: HPE noted that the AOS-CX 10.10.1181 version has reached End of Maintenance (EOM) and only receives fixes for internally discovered, critical issues, a condition that also applies to CVE-2026-73749. ArubaOS-CX is HPE Aruba Networking’s operating system for its enterprise-grade network switches, typically used by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers. HPE's security bulletin also covers a set of 23 other security vulnerabilities, some with high severity ratings, between 8.1 and 8.8: The vendor “strongly encourages” customers to upgrade to one of the fixed releases listed in the bulletin. HPE mentions that, at the time of the bulletin’s publication, it was not aware of active exploitation or p...
HPE patches critical ArubaOS-CX remote code execution flaw
Affected Software
Frequently Asked Questions
What is the impact of CVE-2026-73749 in ArubaOS-CX?
CVE-2026-73749 is a critical buffer overflow that can allow an unauthenticated remote attacker to send specially crafted packets to an affected daemon process. Successful exploitation could result in remote code execution with elevated privileges.
Which ArubaOS-CX systems need attention?
The issue affects ArubaOS-CX release branches identified in HPE’s bulletin. Organizations using AOS-CX 10.10.1181 should note that it has reached End of Maintenance, although HPE states it receives fixes for internally discovered critical issues such as CVE-2026-73749.
Is exploitation dependent on valid credentials or local access?
No. HPE states that an unauthenticated remote attacker could exploit the vulnerabilities by sending specially crafted packets to the affected service.
What remediation action is indicated?
HPE has released fixes for the affected ArubaOS-CX release branches listed in its security bulletin. Administrators should identify deployed affected versions and apply the corresponding listed fix.