HEWLETT Packard Enterprise (HPE) has released patches for 34 vulnerabilities in its ArubaOS-CX (AOS-CX) platform, including critical remote code execution flaws. The fixes cover nearly two dozen issues grouped under CVE-2026-73749, which SecurityWeek notes carries a CVSS score of 9.8.
The updates also address 22 high-severity CVEs that could lead to denial-of-service, RCE, arbitrary command execution, browser-script execution, authentication bypass, privilege escalation, and information disclosure, as well as 11 medium-severity CVEs related to access controls bypass, information disclosure, arbitrary file reads, DoS and privilege escalation. HPE lists AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181 as patched, with many bugs tracked under the same CVEs.
The vulnerabilities stem from improper handling of malformed input to an unnamed service within HPE’s database-centric operating system for enterprise switches. An unauthenticated attacker could exploit the flaws by sending crafted packets to the vulnerable service, achieving RCE with elevated privileges. HPE states most of the issues were discovered internally and that it is not aware of any active exploitation in the wild.
To reduce risk, the vendor recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or controlling them via firewall policies at layer 3 and above, with accounting controls to track user activity and resource usage.