CVE-2026-73749
CVSS 9.8 CRITICAL: multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. EPSS 0.8% (55th percentile).
Vulnerabilities · 51 days ago
NCSC-NL said Aruba Networks fixed multiple ArubaOS-CX vulnerabilities across the switch’s CLI, API endpoints, web management interface, daemon, and operating system. The 26 CVEs span authentication bypass, remote code execution, privilege escalation, information disclosure, cross-site request forgery, server-side request forgery, and denial of service.
The common thread is the management plane: some bugs can be reached without authentication, while others need only a low-privilege account. In plain terms, a reachable admin path can turn into config changes, sensitive-data access, code execution, or disruption on the switch itself, so the issue is not confined to one failed component.
For operators that use ArubaOS-CX for segmentation or access control, the exposure sits in the device’s own control surfaces, not in a peripheral service. If those interfaces are reachable in your environment, the residual risk after patching is whether any unpatched device still exposes the same management paths.
CVSS 9.8 CRITICAL: multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. EPSS 0.8% (55th percentile).
4 sources covering this story
Risolte vulnerabilità in HPE Aruba Networking ArubaOS-CX
Aggiornamenti di sicurezza HPE sanano numerose vulnerabilità di sicurezza, tra cui una con gravità “critica” e 22 con gravità “alta”, che interessano ArubaOS-CX, sistema operativo di rete utilizzato negli switch HPE Aruba Networking.
HPE Patches Critical RCE Vulnerabilities in AOS-CX
Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.
HPE patches critical ArubaOS-CX remote code execution flaw
Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.
Kwetsbaarheden verholpen in Aruba Networks ArubaOS-CX
Aruba Networks heeft meerdere kwetsbaarheden verholpen in het AOS-CX netwerk besturingssysteem en de bijbehorende componenten, waaronder de command line interface, API endpoints en web-based management interface.
Risolte vulnerabilità in prodotti HPE Aruba Networking
Rilasciati aggiornamenti di sicurezza per risolvere 86 vulnerabilità, di cui 6 con gravità "critica" e 46 con gravità "alta", che interessano i prodotti HPE Aruba Networking AOS-CX e Fabric Composer.
Part of the PlainSec briefing for 2026-09-08