HPE patches critical unauthenticated RCE in ArubaOS-CX switches

Hewlett Packard Enterprise has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution, BleepingComputer reported. Tracked as CVE-2026-73749, the flaw is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process and achieve code execution with elevated privileges. HPE's bulletin says multiple vulnerabilities exist in an ArubaOS-CX daemon that may allow improper processing of malformed input. Fixed versions by release branch are 10.18.1002 or later for 10.18.0001, 10.17.1030 or later for 10.17.1021 and earlier, 10.16.1060 or later for 10.16.1051 and earlier, 10.13.1190 or later for 10.13.1180 and earlier, and 10.10.1181 or later for 10.10.1180 and earlier. HPE noted that version 10.10.1181 has reached End of Maintenance and only receives fixes for internally discovered critical issues, a condition that applies to this CVE. ArubaOS-CX runs HPE Aruba Networking's enterprise switches, which are typically deployed by large businesses, government agencies, universities, healthcare organizations, data centers and service providers. Because the flaw requires no authentication and targets core network infrastructure, administrators should schedule upgrades promptly and consider limiting network exposure of the affected service until patched.