Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
HPE released patches on September 1, 2026 for 34 vulnerabilities in the ArubaOS-CX (AOS-CX) platform, the operating system powering enterprise, data center, and campus switches. Two of these flaws allow unauthenticated remote code execution, with maximum impact on the risk of network traffic compromise. The severity lies not just in individual gravity: the two RCE paths are independent, touch distinct components of the operating system, and both require only network reachability — no authentication or user interaction.
- CVE-2026-73749 groups roughly two dozen issues in an AOS-CX daemon: buffer overflow with unauthenticated RCE and elevated privileges, CVSS 9.8 per the HPE advisory.
- CVE-2026-73782 is a second independent RCE flaw, a format string in the CLI, with a high CVSS: an attacker can reach the same objective through a different mechanism.
- 34 CVEs total, including 22 high-severity (8.1–8.8) and 11 medium-severity; the majority discovered internally by the HPE security team.
- HPE is not aware of exploits in the wild or public proof-of-concept code at the time of the advisory's publication.
The Buffer Overflow in CVE-2026-73749: Memory Corruption on an Open Network
The official HPE advisory (HPESBNW05134) describes CVE-2026-73749 as a set of vulnerabilities in an ArubaOS-CX daemon that fails to properly validate input size. An unauthenticated remote attacker sends crafted packets to the affected service. The lack of validation causes a buffer overflow, resulting in memory corruption and arbitrary code execution with elevated privileges. The attack vector is network, complexity is low, no privileges required, no user interaction: the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector assigns a score of 9.8, critical.
The daemon is not identified by name in official documents. Nearly two dozen distinct issues have been grouped under this identifier, suggesting a code area with systematically insufficient bounds checking rather than an isolated bug.
The Second Path: Format String RCE in the CLI
CVE-2026-73782 introduces an entirely different variable. According to TechTimes analysis, this vulnerability is a format string in the switch's command-line interface. The impact is identical in terms of objective — remote code execution — but the failure mechanism is orthogonal to the first: where CVE-2026-73749 exploits a memory management error in a network service, CVE-2026-73782 exploits an input parsing error in the CLI.
This dual independence is the datum that elevates risk from critical to systemic. Partial compensating controls — rate limiting on one service, monitoring of a specific protocol, restricting access to an interface — are ineffective against an attacker who can switch vectors. If one path is blocked, the other remains open.
"Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges." — HPE Advisory HPESBNW05134
Hardware Scope and Versions: Dozens of CX Models Under Scrutiny
The NVD record for CVE-2026-73749 extends the hardware context to dozens of Aruba CX models: 6000, 6100, 6200, 6300, 6400, 8320, 8325, 8360, 8400, 9300, 10000 series and others. These switches operate at Layer 2/Layer 3 of the network core, a position that makes compromise particularly sensitive: an actor with RCE on switching infrastructure can intercept, redirect, or manipulate organizational traffic before it reaches endpoints or perimeter firewalls.
Affected versions span five branches: 10.18.0001 and earlier, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, 10.10.1180 and earlier. The fixed builds are respectively 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181.
The 10.10.x branch is in End of Maintenance (EOM). The HPE advisory indicates it receives fixes only for critical issues discovered internally. This condition exposes organizations with upgrades blocked by compatibility or budget to a potentially longer exposure window, with risk of support interruption for future vulnerabilities.
The Rest of the Bulletin: 32 CVEs Beyond the Two Main RCEs
SecurityWeek reports that 22 high-severity CVEs — with CVSS scores between 8.1 and 8.8 — include denial of service, additional RCEs, command injection, cross-site scripting, authentication bypass, and privilege escalation. The remaining 11 are medium severity and involve access control bypass, information disclosure, arbitrary file read, DoS, and privilege escalation.
CVE-2026-73778 (CVSS 8.1, HIGH) warrants separate attention: it allows full administrative access via a predictable factory-default password on unconfigured devices. According to BleepingComputer, this flaw reduces the access barrier to zero for attackers with physical or network reachability to newly installed or reset switches.
What to Do Now
HPE recommends applying patches to the fixed versions for each active branch. The advisory also suggests restricting CLI and web interface access to dedicated Layer 2 VLANs and/or Layer 3 and above firewall policies, reducing the attack surface exposed to remote vectors.
For organizations with Virtual Switching Extension (VSX), nflo.tech reports that dedicated upgrade procedures minimize operational downtime, though the dossier does not specify technical details of these procedures.
No indications emerge in the brief regarding alternative compensating controls, workarounds without patching, or specific monitoring actions to detect attempted exploitation.
Technical Debt at the Core of Enterprise Switching
The coexistence of buffer overflow and format string in the same bulletin, both with unauthenticated RCE impact, indicates a code quality problem that transcends the individual vulnerability. The two failure mechanisms require distinct defective programming patterns: missing memory bounds checking in one case, missing format input validation in the other. The internal discovery of most flaws — a positive datum for vendor responsibility — does not mitigate the structural issue: the AOS-CX codebase contains areas with insufficiently robust development practices for software running on critical network infrastructure.
The switch's architectural position — silent, fundamental, often overlooked in patch cycles compared to servers and endpoints — makes it a high-value target for sophisticated actors. The ability to execute code at this level does not require compromising endpoints, bypassing EDR, or engineering phishing: it requires only network reachability to an exposed daemon.
The absence of confirmed exploitation at the time of publication offers an operational window, but the unauthenticated nature of the flaws and the simplicity of the vector (crafted packets) suggest proof-of-concept code may emerge on compressed timelines once patches are analyzed.
Sources
- https://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/
- https://securityonline.info/hpe-aos-cx-cve-2026-73749-rce/
- https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/
- https://nflo.tech/knowledge-base/2026-09-01-cve-2026-73749-en/
- https://www.techtimes.com/articles/326586/20260904/hpe-patches-arubaos-cx-two-independent-no-credentials-rce-paths-found-same-bulletin.htm
- https://nvd.nist.gov/vuln/detail/CVE-2026-73749
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US
Information verified against cited sources and current as of publication.
Sources
- https://www.prsol.cc/2026/09/04/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/
- https://podcast.securityweek.com/
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.