GoKawiilHPE fixes critical unauthenticated RCE flaw in ArubaOS-CX switches
HPE has released patches for CVE-2026-73749, a critical buffer overflow in ArubaOS-CX that lets unauthenticated attackers send malformed packets to a daemon to gain elevated code execution. The bulletin also lists 23 other vulnerabilities, several rated high severity, affecting management and web modules across multiple AOS-CX release branches. One vulnerable version has already reached end of maintenance but still received a fix due to the severity of the flaw.