Hewlett Packard Enterprise (HPE) has released critical security patches for 34 vulnerabilities in its Aruba Networking ArubaOS-CX (AOS-CX) platform, which includes enterprise switches. The company’s advisory reveals that a staggering 150 flaws were resolved across various versions of AOS-CX. Among these, nearly two dozen critical-severity remote code execution (RCE) vulnerabilities have been addressed.
The RCE vulnerabilities are caused by the improper processing of malformed input sent to an unspecified service within HPE’s database-centric operating system for enterprise switches. This can be exploited by an unauthenticated attacker sending crafted packets to the vulnerable service, allowing them to execute arbitrary code with elevated privileges. The severity of these flaws is reflected in their CVSS (Common Vulnerability Scoring System) score, which ranges from 5.3 to a maximum of 9.8 for the most critical ones.
While HPE emphasizes that it’s not aware of any exploitation of these vulnerabilities in the wild, the company recommends taking immediate action to mitigate potential attacks. It advises restricting access to the command-line interface (CLI) and web-based management interfaces to a dedicated network segment or VLAN, and configuring firewall policies at layer 3 and above to control traffic flow.
The patches also address 22 high-severity vulnerabilities that could lead to denial-of-service (DoS), RCE, arbitrary command execution, authentication bypass, privilege escalation, and information disclosure. The remaining 11 CVEs are classified as medium-severity flaws, including access controls bypass, information disclosure, arbitrary file reads, DoS, and privilege escalation.
HPE’s internal security team discovered the majority of these vulnerabilities, highlighting the importance of proactive security measures within organizations. As with any critical update, it’s essential for administrators to promptly apply the patches to their AOS-CX systems to prevent potential attacks.
In light of this development, HPE Networking urges users to review and implement best practices for securing their network infrastructure. This includes:
* Restricting access to management interfaces
* Configuring firewall policies to control traffic flow
* Monitoring system logs for suspicious activity
* Regularly applying security updates
By taking these precautions, organizations can minimize the risk of exploitation and ensure the secure operation of their enterprise switches.
Source: SecurityWeek — 2026-09-04