A Critical Flaw in HPE’s ArubaOS-CX Network Operating System Puts Enterprises at Risk
Hewlett Packard Enterprise (HPE) has released a critical patch for its ArubaOS-CX network operating system, fixing a vulnerability that could allow an attacker to execute malicious code on affected devices. The flaw, tracked as CVE-2026-73749, is a buffer overflow that can be exploited by sending specially crafted packets to the affected daemon process.
ArubaOS-CX is a robust network operating system used by large enterprises, government agencies, universities, and other organizations to manage their network infrastructure. However, the newly patched vulnerability poses a significant threat to these organizations, as an attacker with remote access could potentially gain elevated privileges on the device.
According to HPE’s security bulletin, the flaw affects various release branches of ArubaOS-CX, including 10.18.0001 and earlier versions. To mitigate this risk, affected customers are advised to upgrade their systems to a fixed release listed in the bulletin. Specifically, users running version 10.18.0001 should upgrade to 10.18.1002 or later, while those on version 10.17.1021 or earlier should upgrade to 10.17.1030 or later.
But that’s not all – HPE’s security bulletin also covers a set of 23 other vulnerabilities with high severity ratings. These flaws include potential issues such as denial-of-service (DoS) attacks, cross-site scripting (XSS), and remote code execution. While the company emphasizes that it is not aware of active exploitation or publicly available proof-of-concept exploits targeting these listed flaws, the sheer number of vulnerabilities highlights the importance of keeping software up-to-date.
It’s worth noting that HPE has noted that AOS-CX 10.10.1181 version has reached End of Maintenance (EOM) and only receives fixes for internally discovered, critical issues, including CVE-2026-73749. This means that users running this version will not receive any further updates or patches.
To stay safe, HPE strongly encourages customers to upgrade their systems as soon as possible. It’s essential for administrators to regularly review software versions and apply necessary patches to prevent potential exploitation of these vulnerabilities.
In today’s interconnected world, network security is paramount. Enterprises must prioritize patching and updating their software to mitigate the risk of attacks. By doing so, they can protect themselves from potential threats like CVE-2026-73749 and ensure the integrity of their networks.
As a practical takeaway for readers, it’s crucial to regularly review and update software versions, especially network operating systems like ArubaOS-CX. This will help prevent potential exploitation of vulnerabilities and keep your network secure. Additionally, be sure to follow best practices for patch management, including automating updates where possible, to stay ahead of potential threats.
Source: Bleeping Computer — 2026-09-03