GoKawiilHPE fixes critical unauthenticated RCE flaw in ArubaOS-CX switches
HPE has released patches for CVE-2026-73749, a critical buffer overflow in ArubaOS-CX that lets unauthenticated attackers send malformed packets to a daemon to gain elevated code execution. The bulletin also lists 23 other vulnerabilities, several rated high severity, affecting management and web modules across multiple AOS-CX release branches. One vulnerable version has already reached end of maintenance but still received a fix due to the severity of the flaw.
GoKawiil's interpretation of the reporting above, not reported fact.
ArubaOS-CX runs enterprise switches used by large organizations, universities, hospitals and service providers, making an unauthenticated remote execution bug especially dangerous since it requires no credentials to exploit. Network infrastructure sitting at this level of an organization's stack is a prime target for lateral movement and disruption if left unpatched.
- CVE-2026-73749 allows unauthenticated remote code execution via crafted packets to an ArubaOS-CX daemon.
- Patches are available across five release branches, with one legacy version getting an exception fix despite reaching end of maintenance.
- 23 additional vulnerabilities, some rated high severity, were also disclosed and patched in the same bulletin.
Cable Matters USB to RJ45 Console Cable — Patching switch firmware like ArubaOS-CX often means a serial console session when the management plane is unreachable. A USB-to-RJ45 console cable from Cable Matters keeps a laptop connected directly to the switch's console port so you can push the upgrade and recover if a reboot goes sideways. A cheap, indispensable item for any network admin's bag.
See Cable Matters USB to RJ45 Console Cable on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-03
Published there as: “HPE patches critical ArubaOS-CX remote code execution flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.