HPE Patches Critical ArubaOS-CX Vulnerability

Hewlett Packard Enterprise has released security updates for a critical ArubaOS-CX vulnerability that could allow unauthenticated attackers to execute code remotely with elevated privileges.

Tracked as CVE-2026-73749, the flaw affects the operating system used across HPE Aruba Networking enterprise switches. HPE strongly urges customers to upgrade to a fixed release.

Critical flaw allows remote code execution

The ArubaOS-CX vulnerability is a buffer overflow in a daemon process. An attacker can exploit it by sending specially crafted packets to the affected service.

Successful exploitation could allow the attacker to run code with elevated privileges on the targeted device. The attack does not require authentication, making exposed or reachable devices a priority for patching.

ArubaOS-CX runs on network switches commonly deployed by large businesses, government agencies, universities, healthcare organisations, data centres and service providers.

Fixed ArubaOS-CX releases

HPE has issued the following fixed versions:

• ArubaOS-CX 10.18.0001: upgrade to 10.18.1002 or later
• ArubaOS-CX 10.17.1021 and earlier: upgrade to 10.17.1030 or later
• ArubaOS-CX 10.16.1051 and earlier: upgrade to 10.16.1060 or later
• ArubaOS-CX 10.13.1180 and earlier: upgrade to 10.13.1190 or later
• ArubaOS-CX 10.10.1180 and earlier: upgrade to 10.10.1181 or later

The 10.10.1181 release has reached end of maintenance. HPE noted that it receives fixes only for internally discovered critical issues, including this one.

Patch bundle addresses additional flaws

HPE’s bulletin also covers 23 additional security flaws, several rated high severity. The issues include vulnerabilities that could enable denial-of-service attacks, command execution, arbitrary file writes, authentication bypasses and privilege escalation.

Other flaws affect the ArubaOS-CX web management interface, command-line interface and API endpoints. Some require low-privileged access, while others require only adjacent-network access.

HPE said it was not aware of active exploitation or public proof-of-concept exploits for the listed vulnerabilities when it published the bulletin. Even so, organisations should identify affected switches and apply the available updates as soon as possible.