Vulnerabilities & Exploits

ArubaOS-CX advisory puts switch management at risk

NCSC-NL said Aruba Networks fixed multiple ArubaOS-CX vulnerabilities across the switch’s CLI, API endpoints, web management interface, daemon, and operating system. The 26 CVEs span authentication bypass, remote code execution, privilege escalation, information disclosure, cross-site request forgery, server-side request forgery, and denial of service.

The common thread is the management plane: some bugs can be reached without authentication, while others need only a low-privilege account. In plain terms, a reachable admin path can turn into config changes, sensitive-data access, code execution, or disruption on the switch itself, so the issue is not confined to one failed component.

For operators that use ArubaOS-CX for segmentation or access control, the exposure sits in the device’s own control surfaces, not in a peripheral service. If those interfaces are reachable in your environment, the residual risk after patching is whether any unpatched device still exposes the same management paths.

4 sources · Sep 7

CVE-2026-73749

NVD KEV

CVSS 9.8 CRITICAL: multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. EPSS 0.8% (55th percentile).

Timeline

Sources

Sep 7 CSIRT Italia / ACN
Risolte vulnerabilità in HPE Aruba Networking ArubaOS-CX
Aggiornamenti di sicurezza HPE sanano numerose vulnerabilità di sicurezza, tra cui una con gravità “critica” e 22 con gravità “alta”, che interessano ArubaOS-CX, sistema operativo di rete utilizzato negli switch HPE Aruba Networking.
original
Sep 4 SecurityWeek
HPE Patches Critical RCE Vulnerabilities in AOS-CX
Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.
original
Sep 3 BleepingComputer
HPE patches critical ArubaOS-CX remote code execution flaw
Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.
original

Part of the PlainSec briefing for 2026-09-04

Every edition of this story: ArubaOS-CX advisory puts switch management at risk

More from today

Vulnerabilities & ExploitsArubaOS-CX advisory puts switch management at riskNCSC-NL said Aruba Networks fixed multiple ArubaOS-CX vulnerabilities across the switch’s CLI, API endpoints, web management interface, daemon, and operating system. The 26 CVEs span authentication bypass, remote code execution, privilege escalation, information disclosure, cross-site request forgery, server-side request forgery, and denial of service.The common thread is the management plane: some bugs can be reached without authentication, while others need only a low-privilege account. In plain terms, a reachable admin path can turn into config changes, sensitive-data access, code execution, or disruption on the switch itself, so the issue is not confined to one failed component.For operators that use ArubaOS-CX for segmentation or access control, the exposure sits in the device’s own control surfaces, not in a peripheral service. If those interfaces are reachable in your environment, the residual risk after patching is whether any unpatched device still exposes the same management paths.4 sources · Sep 7

CVE-2026-73749

NVD KEV

CVSS 9.8 CRITICAL: multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. EPSS 0.8% (55th percentile).

Timeline

Sep 7 Reported by CSIRT Italia / ACN

Sep 4 Reported by SecurityWeek

Sep 3 Reported by BleepingComputer

Sources

Sep 7 CSIRT Italia / ACN

Risolte vulnerabilità in HPE Aruba Networking ArubaOS-CX

Aggiornamenti di sicurezza HPE sanano numerose vulnerabilità di sicurezza, tra cui una con gravità “critica” e 22 con gravità “alta”, che interessano ArubaOS-CX, sistema operativo di rete utilizzato negli switch HPE Aruba Networking.

original

Sep 4 SecurityWeek

HPE Patches Critical RCE Vulnerabilities in AOS-CX

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

original

Sep 3 BleepingComputer

HPE patches critical ArubaOS-CX remote code execution flaw

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.

original

Part of the PlainSec briefing for 2026-09-04Every edition of this story: ArubaOS-CX advisory puts switch management at riskMore from today

Wordfence sees mass WordPress shell drops

Citrix NetScaler Gateway flaw hits KEV list

CrowdStrike Falcon mitigation leaves macro cleanup gap