How to Protect Aruba Switches

On September 1, 2026, HPE Aruba Networking released updates addressing 34 CVEs in ArubaOS-CX (AOS-CX), the operating system used in the company’s enterprise switches. The most severe vulnerability, CVE-2026-73749, has a CVSS score of 9.8. It is a buffer overflow in an AOS-CX daemon that allows an unauthenticated attacker to execute code with elevated privileges by sending specially crafted packets. No login or user interaction is required, and the attack complexity is low.

Key Takeaways:

• CVE-2026-73749 is a buffer overflow in an AOS-CX daemon rated CVSS 9.8 critical, exploitable by unauthenticated attackers who can send crafted packets to the affected service.
• A second unauthenticated vulnerability, CVE-2026-73752, is an API path traversal (CWE-22) rated 8.8 that allows arbitrary file writes on the underlying OS, potentially leading to code execution.
• HPE reports no known active exploitation or public exploit code, and CVE-2026-73749 is not included in CISA’s Known Exploited Vulnerabilities catalog.
• The first fixed release in each branch is 10.10.1181, 10.13.1190, 10.16.1060, 10.17.1030, or 10.18.1002 and later; the 10.10.x branch has reached End of Maintenance.
• HPE recommends restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN behind a firewall policy as an interim mitigation.

The bulletin addresses over 150 flaws grouped under 34 CVEs, including buffer overflows, command injection, cross-site scripting, authentication bypass, and insecure default settings. HPE’s advisory notes that most vulnerabilities were discovered by internal security researchers at HPE Networking. This detail matters for defenders assessing urgency: these issues were not first disclosed by external researchers with public exploits.

What CVE-2026-73749 Actually Is

The MITRE record for CVE-2026-73749 describes “multiple vulnerabilities exist in daemon of AOS-CX that may allow for improper processing of malformed input,” which an unauthenticated remote attacker can exploit by sending specially crafted packets. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network accessibility, low attack complexity, no privileges required, and no user interaction. CISA’s Vulnrichment metadata assigns CWE-284 (Improper Access Control).

The key phrase in that record is “multiple vulnerabilities.” SecurityWeek reports that nearly two dozen issues were grouped under CVE-2026-73749 instead of being assigned separate identifiers. For asset managers, this means a single CVE entry may cover a cluster of related input-handling bugs in the same daemon. Fixing one does not guarantee fixing the entire cluster; the patched release addresses all of them together.

HPE does not specify the daemon, protocol, or port in the advisory. This omission limits the effectiveness of signature-based detection. Analysts cannot create reliable rules for “traffic to the vulnerable service” without knowing which service is affected. The advisory does clarify the reachability condition: if an attacker can send packets to the affected service, the overflow vulnerability is exploitable on an unpatched device.

The execution context explains the high severity score. The flaw exists in a daemon rather than an application process, so successful exploitation results in code running with the daemon’s privileges on the switch. From there, an attacker can modify routing and access control settings, add administrative accounts, or use the switch to monitor traffic passing through it. Network devices have a multiplying effect on security because all downstream traffic depends on their integrity.

The Other Path Into the Same Device

CVE-2026-73749 is not the only unauthenticated vulnerability in this bulletin. CVE-2026-73752 is an unauthenticated arbitrary file write vulnerability in an AOS-CX API endpoint, rated CVSS 8.8 with an adjacent-network attack vector and CWE-22 (path traversal). MITRE’s description states that successful exploitation allows an attacker to write arbitrary files to the underlying operating system, which “could lead to remote code execution.”

The practical difference is in the network position required. CVE-2026-73749 requires network reachability from the attacker’s location; CVE-2026-73752 requires only adjacency, which is easy to achieve in a flat campus or data center network. An attacker on any host within the same broadcast domain or routed segment may exploit it.

Two additional vulnerabilities expand the attacker’s options after gaining access. CVE-2026-73751 allows a low-privileged authenticated user to submit crafted input via the web management interface to execute arbitrary commands on the underlying OS (CVSS 8.8). CVE-2026-73778 is a Credential Manager weakness (CWE-521, Weak Password Requirements) rated 8.1, where an unauthenticated remote attacker can use a predictable factory-default password to gain full administrative control of a device still in its factory-default or post-ZTP state. The MITRE vector for 73778 sets attack complexity to HIGH, unlike the 9.8 flaw, because exploitation depends on the device remaining unconfigured.

Regarding scoring discrepancies: some third-party CVE aggregators list CVE-2026-73778 at 9.8. The authoritative MITRE record and CISA’s weekly vulnerability summary both list it as 8.1. Treat the aggregator rating as incorrect and rely on NVD or MITRE when prioritizing.

Affected Branches and Fix Matrix

HPE’s advisory identifies five affected branches. Each row shows the last affected release and the first fixed release. Upgrading beyond the fixed version is necessary; matching the fixed version alone is not enough.

The 10.10.x branch has a specific note: due to its age and complexity, only internally identified critical-severity vulnerabilities were fixed in 10.10.1181. Some vulnerabilities listed in the bulletin may remain unpatched on this branch. The advisory also states that software beyond End of Support was not evaluated for exposure, so such installations should be considered potentially vulnerable.

The recommended mitigation focuses on controlling access rather than code changes. HPE advises restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN and/or enforcing firewall policies at Layer 3 and above, along with logging user activity and resource usage. This does not address CVE-2026-73749, which is triggered by packets sent to a service that may not be the management interface. However, it significantly reduces exposure to the API, web, and CLI vulnerabilities in the same bulletin.

Exploitation Status and What Not to Assume

HPE’s advisory states the company was “not aware of any public discussion or exploit code” targeting these vulnerabilities as of the September 1 release date. CVE-2026-73749 is not listed in CISA’s Known Exploited Vulnerabilities catalog, and independent analysis from Rescana confirms no confirmed reports of exploitation in the wild as of September 2026. No public proof-of-concept or known exploitation exists at the time of publication.

This lack of current exploitation does not guarantee future safety. CISA’s Vulnrichment metadata for CVE-2026-73749 marks the flaw as “Automatable: yes,” indicating an exploit could run without manual steps once developed. A 9.8 unauthenticated remote code execution vulnerability in widely deployed switching hardware is a valuable target for attackers, so the patch window should be considered limited.

This bulletin should not be confused with an earlier ArubaOS-CX advisory. In March 2026, HPE patched CVE-2026-23813, a separate 9.8 authentication bypass in the AOS-CX web management interface that allowed resetting an admin password. That is a different CVE, advisory, and component. Mixing the March flaw with the September patch wave causes errors that may persist in incident reports.

Detection When Crash Logs Are Not Enough

Because HPE does not disclose the affected daemon, detection must rely on behavioral indicators. Daemon crash logs and reboot histories are useful to collect, but a crash alone does not prove code execution; memory corruption and process failures can occur during normal faults. Treat crashes as triggers for further investigation rather than confirmation of compromise.

Detection signals for switch infrastructure, based on artifacts described in the bulletin and third-party incident analyses, include:

• Config diffs. Unexpected changes to ACLs, routing entries, or management settings indicate that something with privileged access altered device state. Compare against a documented baseline regularly, not only after alerts.
• Local account and key creation. New local users or added SSH keys on a switch usually have no legitimate reason in managed environments.
• Outbound connections from switch management addresses. Network hardware rarely initiates connections to arbitrary internet destinations. Such traffic should be investigated.
• Auth anomalies. Repeated administrative logins from unfamiliar source addresses, especially near the management VLAN boundary.
• Factory-default state inventory. CVE-2026-73778 requires a device that has never had credentials configured. If your inventory cannot identify switches still in factory-default or post-ZTP state, that is a security gap.

Centralized management platforms provide the best place to check because they store configuration history and firmware records for the entire fleet. A compromised switch may appear normal on its own but stand out in a configuration timeline. If you operate an AOS-CX management system, ensure it is patched and does not rely on default credentials for authentication.

Hardening Checklist

• Inventory every AOS-CX device with its exact running version, and flag any on 10.10.1180 and below, 10.13.1180 and below, 10.16.1051 and below, 10.17.1021 and below, or 10.18.0001.
• Prioritize patching CVE-2026-73749 and CVE-2026-73752 quickly; both are unauthenticated and lead to code execution.
• Upgrade to 10.18.1002 and above, 10.17.1030 and above, 10.16.1060 and above, 10.13.1190 and above, or 10.10.1181 and above as applicable.
• Plan to replace hardware running the 10.10.x branch. It has reached End of Maintenance and only received fixes for internally identified critical issues.
• Ensure no device remains in factory-default or post-ZTP state, and set credentials during provisioning rather than after deployment.
• Move CLI and web management interfaces to a dedicated Layer 2 segment or VLAN, with firewall policies at Layer 3 and above.
• Enable logging of user activity and resource usage, and send those logs off-device so a compromised switch cannot delete them.
• Establish a configuration baseline and compare against it regularly.
• Verify patch levels after any field replacement or RMA, since returned units might have older firmware.

The Pattern Behind the Bulletin

This advisory includes 34 CVEs and over 150 fixed flaws in a single network operating system release. SecurityWeek’s analysis counts 22 high-severity and 11 medium-severity entries alongside the critical cluster. The number of bugs in switching software reflects a large attack surface that has grown over years of feature additions. Network operating systems have historically received less urgent patching than identity or endpoint systems until a serious issue arises.

The short support lifecycle of the 10.10.x branch illustrates the operational issue. When a supported branch reaches End of Maintenance and only critical fixes are applied, the remaining risk includes unfixed vulnerabilities and the likelihood that future advisories will follow the same limited scope. Hardware refresh planning should treat firmware branch status as a security factor, not just a support convenience.

Another pattern is the presence of two independent unauthenticated paths to code execution in the same bulletin: a buffer overflow in a daemon and a path traversal in an API. Attackers can exploit both on the same device. This supports treating the entire bulletin as a single patch event rather than ranking CVEs and stopping after the highest severity one.

Prediction: CVE-2026-73749 will not be added to the CISA Known Exploited Vulnerabilities catalog before March 31, 2027. If it is added, it will likely be due to a public proof-of-concept emerging after fixed releases have been widely deployed.

Related Reading

More in-depth coverage from this blog on closely related topics:

• Cloudflare Workers vs AWS Lambda

Sources and References

Sources cited while researching and writing this article:

• https://cveawg.mitre.org/api/cve/CVE-2026-73749
• HPE Patches Critical RCE Vulnerabilities in AOS-CX – SecurityWeek
• https://cveawg.mitre.org/api/cve/CVE-2026-73752
• https://cveawg.mitre.org/api/cve/CVE-2026-73778
• Critical CVE-2026-73749 Remote Code Execution Vulnerability in HPE …