Crafted packets execute code on ArubaOS-CX switches without a login
CVE-2026-73749 lets an unauthenticated attacker run privileged code on HPE Aruba switches by sending malformed packets to a daemon the bulletin never names. The oldest affected branch is already out of maintenance.
The Watch · Security desk
What happened
- CVE-2026-73749 is a buffer overflow in an ArubaOS-CX daemon that lets an unauthenticated remote attacker send crafted packets to the service and execute code with elevated privileges.
- Five release branches need specific fixed builds: 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, and 10.10.1180 and earlier.
- The same bulletin covers 23 further vulnerabilities, some rated between 8.1 and 8.8, including a predictable factory-default password and an adjacent-network authentication bypass.
- HPE said that when the bulletin was published it knew of no active exploitation and no public proof-of-concept code for any of the listed flaws.
Why it matters
- Who's exposed exposure ArubaOS-CX runs the switching layer for government agencies, universities, hospitals, data centers and service providers, so the reachable asset here is the fabric everything else on the network trusts.
- Who has to decide decision Fleets sitting on the 10.10 branch face a bigger decision than a patch window: fund a branch migration now, or accept that future fixes will only arrive if HPE happens to find the bug itself.
- What it limits constraint Because no daemon or port is published, network teams cannot buy time with a targeted filter; the upgrade is the mitigation, and that pushes the work onto core switch reload windows.
Next story · Build · Oct 1
Kiteworks patches a no-login CVSS 10.0 code-injection flaw in its Email Protection GatewayConfirmed2 publishers
HPE's bulletin does not name the affected daemon or the port it listens on [19]. That removes the usual stopgap. With no service to match, there is no control-plane ACL to stage while a change board argues about a reload on a core switch, and the fixed build is the only control the vendor puts forward [12]. Containment falls back to who can reach the management plane at all, which is the same assumption three of the other flaws in the same bulletin attack from an adjacent network [8][7][9].
The bulletin totals 24 CVEs: one critical plus 23 others [22]. HPE described eleven of them in prose, and seven of those eleven require no credentials [17]. Three of the seven need adjacent-network access, which leaves four reachable by a remote unauthenticated caller: the overflow itself, the API access-control bypass in CVE-2026-73777, the missing CSRF protections in CVE-2026-73780, and the predictable factory-default password in CVE-2026-73778 [18][10][11][14].
CVE-2026-73778 needs no exploit code at all. Per HPE it applies to a switch sitting in factory-default or post-ZTP state, before an administrator configures credentials, and it yields full administrative control [14]. That is an inventory question rather than a research question: how many boxes were racked, provisioned by ZTP, and never had a password set. At the other end, CVE-2026-73781 is less pressing. The stored cross-site scripting requires an authenticated attacker and an administrator who interacts with the content [15].
The 10.10 branch is the clearest case of the pattern. HPE's listed fix for 10.10.1180 and earlier is 10.10.1181 [5], and 10.10.1181 is the build HPE says has reached End of Maintenance, receiving fixes only for internally discovered critical issues [13]. The remediation build and the terminal build are the same build [20]. This CVE qualified under that condition [13]. The next one qualifies only if HPE finds it internally and rates it critical. Note the other end of the list too: 10.18.0001, the newest branch named, is affected as well [5]. Moving to a newer branch alone will not fix this; only the specific builds do.
What to watch
- Public proof-of-concept code or a KEV listing for CVE-2026-73749, which would compress the reload window for every branch on the list.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+15
- Incentives50
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-73749 is a buffer overflow in a daemon of ArubaOS-CX that allows unauthenticated remote attackers to send specially crafted packets to the affected service and achieve code execution with elevated privileges.
- [2]
Hewlett Packard Enterprise has patched a critical remote code execution vulnerability in the ArubaOS-CX network operating system.
- [3]
HPE's bulletin states: "Multiple vulnerabilities exist in a daemon of ArubaOS-CX that may allow for improper processing of malformed input" and that "An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service."
- [4]
HPE said that at the time of the bulletin's publication it was not aware of active exploitation or publicly available proof-of-concept exploits targeting the listed flaws.
- [5]
Affected release branches and fixes listed in the bulletin: 10.18.0001 to 10.18.1002+; 10.17.1021 and earlier to 10.17.1030+; 10.16.1051 and earlier to 10.16.1060+; 10.13.1180 and earlier to 10.13.1190+; 10.10.1180 and earlier to 10.10.1181+.
- [6]
ArubaOS-CX is HPE Aruba Networking's operating system for its enterprise-grade network switches, typically used by large businesses, government agencies, universities, healthcare organizations, data centers, and service providers.
- [7]
CVE-2026-73779: an unauthenticated attacker with adjacent-network access can bypass authentication controls on AOS-CX switches, potentially exposing sensitive information, enabling unauthorized modifications, and disrupting services.
- [8]
CVE-2026-73752: an unauthenticated attacker with adjacent-network access can exploit an AOS-CX API endpoint to write arbitrary files to the underlying operating system, potentially leading to remote code execution.
- [9]
CVE-2026-73782: an unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the AOS-CX command-line interface to execute arbitrary code as a privileged user.
- [10]
CVE-2026-73777: an unauthenticated remote attacker can exploit vulnerabilities in an AOS-CX API endpoint to bypass access controls and escalate privileges.
- [11]
CVE-2026-73780: an unauthenticated remote attacker can exploit missing CSRF protections in some certificate-authenticated AOS-CX sessions to submit arbitrary input to the web-based management interface by convincing an authenticated user to open a crafted URL.
- [12]
HPE "strongly encourages" customers to upgrade to one of the fixed releases listed in the bulletin.
- [13]
HPE noted that AOS-CX 10.10.1181 has reached End of Maintenance and only receives fixes for internally discovered, critical issues, a condition that also applies to CVE-2026-73749.
- [14]
CVE-2026-73778: an unauthenticated remote attacker can use a predictable factory-default password to obtain full administrative control of an AOS-CX device that remains in its factory-default or post-ZTP state before an administrator configures credentials.
- [15]
CVE-2026-73781: an authenticated remote attacker can exploit a stored cross-site scripting vulnerability in the AOS-CX web-based management interface to execute scripts in an administrator's browser if the administrator interacts with the affected content.
- [16]
Three further flaws require credentials: CVE-2026-73750 (low-privileged authenticated remote attacker sends malformed or truncated input to an AOS-CX management module, causing DoS or code execution with elevated privileges), CVE-2026-73751 (low-privileged authenticated user submits crafted input through the web management interface to execute arbitrary commands on the OS), and CVE-2026-73753 (low-privileged authenticated user exploits CLI operations to execute commands as a privileged user).
- [17]
Of the eleven flaws HPE described individually, seven require no authentication: CVE-2026-73749, -73752, -73777, -73778, -73779, -73780 and -73782.
- [18]
Four of the seven unauthenticated flaws are described as reachable by a remote attacker rather than requiring adjacent-network access: CVE-2026-73749, -73777, -73778 and -73780.
- [19]
The bulletin as reported identifies neither the affected daemon by name nor the port or protocol it listens on, referring only to "a daemon of ArubaOS-CX" and "the affected service".
- [20]
For the 10.10 branch, the remediation build and the End of Maintenance build are the same build: 10.10.1181.
- [21]
HPE's security bulletin also covers a set of 23 other security vulnerabilities, some with high severity ratings between 8.1 and 8.8.
- [22]
The bulletin covers 24 CVEs in total.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHPE patches critical ArubaOS-CX remote code execution flaw
1 article · September 3, 2026
- scworld.comHPE patches ArubaOS-CX switches vulnerable to remote code execution
1 article · September 4, 2026
- securityweek.comHPE Patches Critical RCE Vulnerabilities in AOS-CX
1 article · September 4, 2026
Topics and entities
Topics
- Remote Code Execution Surfaces
- Patch And Redeploy Latency
- Network Infrastructure Security
Entities
- HPE Aruba Networking
- Hewlett Packard Enterprise
- Keeper Security