- The Mess: HPE just patched a critical cluster of vulnerabilities in ArubaOS-CX, including a CVSS 9.8 unauthenticated RCE that can hand an attacker elevated code execution on an enterprise switch.
This is not a web application sitting on someone’s forgotten server.
It’s the operating system running the network equipment that moves the traffic.
HPE’s September 1 security bulletin covers a large collection of AOS-CX vulnerabilities. The headline problem is tracked as CVE-2026-73749.
HPE describes multiple buffer-overflow vulnerabilities in an AOS-CX daemon. A remote attacker does not need an account or user interaction. They can send specially crafted packets to the affected service and potentially execute code with elevated privileges.
The CVSS vector is brutal:
CVSS 9.8 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network reachable.
Low complexity.
No credentials.
No victim interaction.
Complete impact across confidentiality, integrity and availability.
- The Damage: A successful compromise could put an attacker directly inside the network infrastructure instead of merely giving them another compromised endpoint.
That distinction matters.
An enterprise switch sits in the path between systems.
Compromise the switch and the attacker potentially gets a privileged position from which to manipulate traffic, disrupt connectivity, observe network activity or use the device as a platform for further attacks.
HPE does not publish enough technical detail to claim that CVE-2026-73749 automatically gives an attacker unrestricted control over every connected system.
It doesn’t.
But a remotely exploitable vulnerability with no authentication requirement and elevated code execution on a network switch is exactly the kind of flaw defenders should patch before somebody works out the missing details.
This Is Bigger Than One CVE
CVE-2026-73749 is only the headline.
HPE’s bulletin contains a much larger collection of AOS-CX security issues, including additional vulnerabilities involving command injection, arbitrary file writing, authentication bypass, path traversal, information disclosure and denial of service.
One particularly nasty companion flaw is CVE-2026-73752, which HPE rates CVSS 8.8 and describes as an unauthenticated arbitrary file-write vulnerability that can lead to remote code execution.
There are also authenticated command-injection vulnerabilities and authentication weaknesses affecting the management interface and APIs.
In other words, this isn’t simply:
“One buffer overflow. Patch it.”
The September bulletin is a broad security cleanup of the AOS-CX attack surface.
The Switch Is the Interesting Target
Attackers usually don’t need to compromise every machine.
They need a position that gives them leverage.
A network switch can be exactly that position.
If an attacker gains privileged execution on infrastructure sitting between servers, workstations and applications, the compromise can become much harder to reason about than a conventional endpoint infection.
A workstation compromise usually starts with:
victim → malware → endpoint
A compromised network device can change the picture:
attacker → infrastructure → multiple networks and systems
That is why vulnerabilities in routers, switches, firewalls and management appliances deserve a different level of attention.
They are part of the trust fabric.
No Public Exploit. Yet.
There is one important piece of good news.
HPE says it was not aware of public discussion or exploit code targeting the listed vulnerabilities at the time of the advisory’s release.
CVE-2026-73749 also currently has no indication of active exploitation in the sources reviewed for this article.
So this is not another “attackers are already inside” story.
It’s a patch-before-that-happens story.
And the CVSS vector leaves very little reason to postpone it.
Which Versions Are Vulnerable?
HPE lists these affected AOS-CX branches:
- 10.18.0001 and earlier
- 10.17.1021 and earlier
- 10.16.1051 and earlier
- 10.13.1180 and earlier
- 10.10.1180 and earlier
The fixed releases are:
- 10.18.1002
- 10.17.1030
- 10.16.1060
- 10.13.1190
- 10.10.1181
The 10.10 branch deserves extra attention because HPE identifies it as End of Maintenance. HPE says only internally identified critical vulnerabilities were addressed for that branch.
For environments running unsupported releases, the security problem is therefore larger than this particular CVE.
Don’t Expose the Management Plane
HPE recommends restricting the CLI and web-based management interfaces to a dedicated Layer 2 segment or VLAN and controlling access with Layer 3 firewall policies.
That’s sensible even after patching.
Management interfaces should not be sitting on the same open network path as ordinary client traffic.
For defenders, the immediate checklist is straightforward:
- inventory every AOS-CX switch;
- identify the exact firmware branch;
- upgrade to a fixed release;
- restrict management access to trusted networks;
- review firewall and ACL rules around management services;
- monitor authentication and administrative activity;
- preserve external logs rather than relying exclusively on the switch itself.
That last point matters if an infrastructure device is ever compromised.
A compromised switch is not the device you want to trust as your only source of evidence.
The Fix
Patch AOS-CX immediately, restrict management interfaces to trusted administrative networks, and treat CVE-2026-73749 as a network-infrastructure priority even though HPE currently reports no public exploit.
- The Fix: Upgrade affected AOS-CX installations to 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 or 10.10.1181, depending on the branch.
Bugstoday Opinion
A CVSS 9.8 RCE on a workstation is bad.
A CVSS 9.8 RCE on the thing connecting the workstations is a different kind of bad.
HPE says there is no public exploit.
Good.
Keep it that way.
The uncomfortable part is that the vulnerability doesn’t need stolen credentials, user interaction or a complicated chain just to get started. The attacker needs network reachability and a working exploit.
That’s a very short shopping list.
And network switches tend to live in places defenders don’t reboot casually, don’t scan aggressively and don’t always patch with the same urgency as Windows endpoints.
That’s exactly why infrastructure vulnerabilities age badly.
The switch is supposed to connect everything.
If somebody owns the switch, they may not need to knock on every door.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
HPE Networking Security Bulletin HPESBNW05134
CVE-2026-73749
CVE-2026-73752
CERT-FR CERTFR-2026-AVI-1104
Rapid7 Vulnerability Database
