### Critical Vulnerability in ArubaOS-CX Demands Immediate Attention **HPE** has announced a critical patch for **ArubaOS-CX**, the operating system powering its enterprise-grade network switches. These switches are widely deployed across large businesses, government agencies, universities, healthcare organizations, data centers, and service providers, making the vulnerability a significant concern for a broad range of organizations. The primary concern is **CVE-2026-73749**, a buffer overflow vulnerability that enables unauthenticated remote attackers to send specially crafted packets to a daemon process. This malicious input can lead to code execution with elevated privileges, posing a severe risk to network integrity and data security. **HPE's** security bulletin states, "Multiple vulnerabilities exist in a daemon of **ArubaOS-CX** that may allow for improper processing of malformed input... An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service." ### Affected Versions and Recommended Upgrades Organizations utilizing **ArubaOS-CX** are strongly urged to upgrade their systems immediately. The affected release branches and their corresponding fixes are: * 10.18.0001 → upgrade to 10.18.1002+ * 10.17.1021 and earlier → 10.17.1030+ * 10.16.1051 and earlier → 10.16.1060+ * 10.13.1180 and earlier → 10.13.1190+ * 10.10.1180 and earlier → 10.10.1181+ It's important to note that **AOS-CX 10.10.1181** has reached End of Maintenance (EOM) and will only receive fixes for internally discovered critical issues, including **CVE-2026-73749**. ### A Broader Spectrum of Vulnerabilities Addressed Beyond the critical remote code execution flaw, **HPE's** comprehensive security bulletin addresses an additional 23 vulnerabilities. Several of these carry high severity ratings, ranging from 8.1 to 8.8. Highlights include: * **CVE-2026-73750:** Allows low-privileged authenticated remote attackers to cause denial of service or execute code with elevated privileges via malformed input to an **AOS-CX** management module. * **CVE-2026-73751:** Enables low-privileged authenticated users to execute arbitrary commands on the underlying operating system through crafted input via the **AOS-CX** web-based management interface. * **CVE-2026-73752:** An unauthenticated attacker with adjacent-network access can exploit an **AOS-CX** API endpoint to write arbitrary files, potentially leading to remote code execution. * **CVE-2026-73753:** Low-privileged authenticated users can exploit affected **AOS-CX** command-line operations to execute arbitrary commands as a privileged user. * **CVE-2026-73782:** An unauthenticated attacker with adjacent-network access can exploit a format-string vulnerability in the **AOS-CX** command-line interface to execute arbitrary code as a privileged user. * **CVE-2026-73781:** An authenticated remote attacker can exploit a stored cross-site scripting (XSS) vulnerability in the **AOS-CX** web-based management interface. * **CVE-2026-73780:** Unauthenticated remote attackers can exploit missing CSRF protections in some certificate-authenticated **AOS-CX** sessions. * **CVE-2026-73779:** An unauthenticated attacker with adjacent-network access can bypass authentication controls on **AOS-CX** switches, leading to information exposure, unauthorized modifications, and service disruption. * **CVE-2026-73778:** An unauthenticated remote attacker can obtain full administrative control of an **AOS-CX** device using a predictable factory-default password if credentials are not configured. * **CVE-2026-73777:** Unauthenticated remote attackers can exploit vulnerabilities in an **AOS-CX** API endpoint to bypass access controls and escalate privileges. ### No Active Exploitation Reported **HPE** has confirmed that, at the time of the bulletin's publication, there was no awareness of active exploitation or publicly available proof-of-concept exploits targeting these newly disclosed flaws. However, the severity of these vulnerabilities underscores the importance of prompt patching to prevent potential attacks.