Hewlett Packard Enterprise has patched a critical buffer overflow vulnerability in the ArubaOS-CX network operating system that powers HPE Aruba enterprise switches. Tracked as CVE-2026-73749, the flaw exists in a daemon process that improperly handles malformed input — an unauthenticated remote attacker can send specially crafted packets to trigger code execution with elevated privileges. ArubaOS-CX is the operating system for HPE Aruba Networking’s enterprise-grade switches, which are widely deployed across large businesses, government agencies, universities, healthcare organizations, and data centers. HPE says it is not aware of any active exploitation or publicly available proof-of-concept code targeting the flaw at the time of its security bulletin’s publication.
In addition to CVE-2026-73749, HPE’s bulletin covers 23 other security vulnerabilities with high severity ratings between 8.1 and 8.8 CVSS. HPE strongly encourages all ArubaOS-CX customers to upgrade to a fixed release. One affected branch, AOS-CX 10.10.1181, has reached End of Maintenance and will only receive fixes for critical internally-discovered issues — customers on that branch should plan to migrate.
How to check if you’re affected
Affected versions of ArubaOS-CX are listed in HPE’s security bulletin for CVE-2026-73749. Log in to your HPE Aruba switch and check the running firmware version against the fixed releases published in the bulletin. If you are on an affected release, upgrade to the fixed version immediately. Administrators of AOS-CX 10.10.1181 (End of Maintenance) should review HPE’s guidance and prioritize migration to a supported and patched branch.