HPE Patches Critical RCE in ArubaOS-CX: Two Independent Exploit Paths in the Same Switch

HPE published bulletin HPESBNW05134 on September 1, 2026, with patches for 34 vulnerabilities in ArubaOS-CX, the operating system for its enterprise switches. Two of these are independent unauthenticated RCEs with completely distinct mechanisms: a buffer overflow in an internet-accessible network daemon, and a format-string flaw in the CLI reachable from an adjacent network. The coexistence of independent paths with the same ultimate impact raises questions about the robustness of the network OS's secure development process.

The 9.8 RCE: Buffer Overflow in the Network Daemon

The core risk is CVE-2026-73749, a collection of multiple buffer overflow vulnerabilities grouped under a single identifier. According to the official HPE advisory, an ArubaOS-CX daemon improperly processes malformed input. An unauthenticated remote attacker sends crafted packets to the affected service to trigger memory corruption and achieve code execution with elevated privileges.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms full network reachability without authentication or user-interaction prerequisites. This is the most dangerous combination for an infrastructure device: the switch does not need to be internet-exposed to be at risk; it suffices that an attacker has access to the network where the vulnerable service is exposed.

HPE did not disclose the daemon name, protocol, or port involved. This omission, common in vendor advisories to prevent accelerated exploit development, prevents organizations from applying specific network controls beyond patching.

"Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges." — HPE Advisory HPESBNW05134

The Second Path: Format String in CLI with Adjacent Network Access

The same bulletin includes CVE-2026-73782, an unauthenticated RCE with CVSS 8.8 and an AV:A (adjacent network) vector. The mechanism differs: a format-string vulnerability in the command-line interface, not in the network stack. The attacker must be on the same network as the device but needs no credentials to achieve elevated code execution.

TechTimes analysis explicitly distinguishes the two paths: buffer overflow in the daemon for CVE-2026-73749, format string in CLI for CVE-2026-73782. The separation of vulnerable components — network stack and management interface — indicates that surface-level defenses on individual services would not mitigate both vectors.

The presence of two bugs with the same ultimate impact (privileged RCE) but distinct technical roots in the same release cycle raises the question of security review depth in AOS-CX. This is not a single flawed attack surface, but development patterns that generate different vulnerability classes in separate components.

The Rest of the Bulletin: 34 CVEs and ~150 Flaws Fixed

Bulletin HPESBNW05134 covers 34 CVE identifiers. According to SecurityWeek, counting multiple instances grouped under single identifiers, the total flaws resolved approaches 150. Severity breakdown: one Critical (9.8), 22 High-severity CVEs with DoS, RCE, command execution, XSS, auth bypass, and privilege escalation impact, and 11 Medium-severity CVEs for access control bypass, information disclosure, arbitrary file reads, DoS, and privilege escalation.

Two additional CVEs warrant attention for their infrastructure risk profile. CVE-2026-73752 (CVSS 8.8, AV:A) allows unauthenticated arbitrary file write via an API endpoint, per BleepingComputer. CVE-2026-73778 (CVSS 8.1, AV:N) grants full administrative access via a predictable factory-default password. The latter is particularly insidious because it exploits a known or derivable factory configuration rather than an implementation vulnerability.

Most vulnerabilities were discovered internally by HPE, two via the bug bounty program. The dossier does not specify which CVEs originated from the external program.

What to Do Now

HPE has made fixed versions available for five branches: 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181. The 10.10.x branch is End of Maintenance and receives fixes only for internally rated critical vulnerabilities; the presence of patch 10.10.1181 confirms CVE-2026-73749 falls in this category. Organizations on earlier branches must plan migration to supported versions.

The vendor advisory recommends restricting CLI and web-based management interfaces to a dedicated Layer 2 segment/VLAN and/or controlling them via Layer 3+ firewall policies. This guidance, cited by SecurityWeek from the primary source, reduces management surface exposure but does not mitigate the CVE-2026-73749 network vector if the vulnerable daemon is reachable on production interfaces.

The 9.8 severity with network access and the absence of confirmed exploits create a temporal window of opportunity. Unpatched systems remain exposed to potential public PoC development, a typical pattern for network-facing vulnerabilities with well-defined vectors. The operational priority is applying patches on switches with direct management or exposure to network segments that are not fully trusted.

Why Two Independent Paths Weigh More Than a Single RCE

The technical reading goes beyond the chronicle of individual CVEs. In a mature network OS like AOS-CX, the simultaneous appearance of a buffer overflow in the dataplane and a format string in the CLI suggests that automated security controls or human code review are not catching fundamental bug classes. The buffer overflow implies missing bounds checking in network-facing code; the format string indicates unsafe use of formatting functions on user input.

Both classes have been known for decades and are detectable with static and dynamic analysis tools. Their coexistence in different components of the same release raises questions about the coverage of the secure development lifecycle applied to the AOS-CX codebase. HPE has not publicly commented on this systemic aspect.

FAQ

Does the switch need to be internet-exposed to be vulnerable?

No. The AV:N vector of CVE-2026-73749 requires only network reachability, not necessarily public exposure. In enterprise environments with imperfect segmentation or lateral access from compromised endpoints, the risk remains concrete.

Why does CVE-2026-73749 score higher than CVE-2026-73782 if both are RCE?

The difference lies in the access vector: 9.8 for AV:N (any network), 8.8 for AV:A (adjacent network). The CVSS v3.1 system rewards reachability without physical proximity or segment barriers.

Is firmware 10.10.1181 a long-term solution?

No. The 10.10.x branch is End of Maintenance. The patch is exceptional for an internal criticality. Organizations must migrate to supported branches to receive regular fixes.

Sources

• https://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/
• https://securityonline.info/hpe-aos-cx-cve-2026-73749-rce/
• https://www.hendryadrian.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/
• https://dev.to/anoymask/arubaos-cx-cve-2026-73749-unauthenticated-rce-via-input-processing-flaw-in-daemon-5b08
• https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/
• https://www.techtimes.com/articles/326586/20260904/hpe-patches-arubaos-cx-two-independent-no-credentials-rce-paths-found-same-bulletin.htm
• https://socradar.io/blog/cve-2026-73749-hpe-arubaos-cx-rce/
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US
• https://podcast.securityweek.com/

Information verified against cited sources and current as of publication.

Sources