Hewlett Packard Enterprise (HPE) recently released patches for 34 critical vulnerabilities in its Aruba Networking ArubaOS-CX (AOS-CX) platform. The updates address nearly two dozen high-severity flaws, including remote code execution (RCE) and denial-of-service (DoS) issues that could be exploited by an unauthenticated attacker.
According to HPE’s advisory, the vulnerabilities are rooted in the improper processing of malformed input sent to a service within the company’s database-centric operating system for enterprise switches. Specifically, attackers could send crafted packets to the vulnerable service, achieving RCE with elevated privileges. This means that even if an attacker doesn’t have access to the network, they can still gain control over the affected device.
The critical security defects are tracked collectively as CVE-2026-73749, which has a CVSS score of 9.8 – the highest possible rating. HPE also addressed 22 high-severity CVEs that could lead to arbitrary command execution, authentication bypass, privilege escalation, and information disclosure. The remaining 11 flaws are medium-severity issues that can result in access controls bypass, information disclosure, arbitrary file reads, DoS, and privilege escalation.
It’s worth noting that the majority of these vulnerabilities were discovered internally by HPE’s security team, and the company is not aware of any of them being exploited in the wild. However, as with all critical vulnerabilities, it’s essential to assume they could be used by attackers at any moment.
To minimize the risk of an attacker exploiting these vulnerabilities, HPE recommends restricting access to the affected devices’ command-line interface (CLI) and web-based management interfaces to a dedicated layer 2 segment or VLAN. Additionally, firewall policies should be implemented at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.
These updates are essential for any organization using HPE’s AOS-CX platform. Failing to patch the affected devices can leave them vulnerable to attacks that could compromise network security, disrupt operations, and lead to significant financial losses.
As a best practice, it’s crucial to regularly review and apply security patches from vendors like HPE. By staying up-to-date with the latest updates and following recommended mitigation strategies, organizations can minimize their attack surface and reduce the risk of a successful cyberattack.
Source: SecurityWeek — 2026-09-04