HPE Aruba Networking shipped a security bulletin (HPESBNW05134) on September 1, 2026 fixing 24 vulnerabilities in ArubaOS-CX, the operating system running on Aruba’s CX-series switches. Two of them stand out: CVE-2026-73749 and CVE-2026-73782 are independent, unrelated bugs that each give an unauthenticated remote attacker full code execution on the switch. Having two unrelated no-credentials RCE paths land in the same bulletin is unusual — most critical-CVE patches ship one headline bug and a tail of lower-severity fixes.

What happened

CVE-2026-73749 (CVSS 9.8) is a buffer overflow in an ArubaOS-CX daemon caused by improper handling of malformed input. A remote attacker sends specially crafted packets to the affected service — no authentication, no user interaction, low attack complexity — and gets code execution with the daemon’s elevated privileges. HPE’s advisory does not name the specific daemon or transport, which is standard practice ahead of public PoC exploitation, but the vector is described as network-reachable.

CVE-2026-73782 is a format-string vulnerability in the ArubaOS-CX command-line interface, also rated high severity. Format-string bugs in CLI/management-plane code typically arise when attacker-controlled input (a hostname, a SNMP string, a syslog message) is passed directly as a format specifier instead of as data, letting an attacker read or write arbitrary memory and pivot to code execution. Combined with CVE-2026-73749, this means two structurally different components of the same switch OS are independently exploitable without credentials.

Neither bug has a public proof-of-concept or confirmed in-the-wild exploitation as of this writing — HPE states it is not aware of active exploitation. Given the severity and the fact that switches are rarely patched on the same cadence as servers, expect researchers to start reverse-engineering the fix within days.

Impact

ArubaOS-CX runs on Aruba’s CX-series switches, widely deployed as core, aggregation, and top-of-rack switching in enterprise, campus, data center, healthcare, education, and service-provider networks. A switch is not an endpoint — compromising one gives an attacker a position to intercept, redirect, or drop traffic for every host behind it, pivot into VLANs, poison ARP/DHCP, or use the switch as a durable foothold that most endpoint security tooling never sees. Unauthenticated, network-reachable RCE on core switching infrastructure is about as close to worst-case as networking CVEs get.

The affected range spans essentially every currently maintained AOS-CX branch:

  • 10.18.0001 and below
  • 10.17.1021 and below
  • 10.16.1051 and below
  • 10.13.1180 and below
  • 10.10.1180 and below

Notably, the 10.10.x branch has already reached End of Maintenance and only receives fixes for internally discovered critical issues — HPE made an exception to patch these two bugs on that branch, underscoring the severity.

Mitigation

Patch immediately. Fixed versions:

  • 10.18.1002
  • 10.17.1030
  • 10.16.1060
  • 10.13.1190
  • 10.10.1181 (EOM branch — plan migration off this release)

Where immediate patching isn’t possible, restrict management and switch-service network access to trusted management VLANs or jump hosts only — these flaws are only reachable if the vulnerable daemon or CLI interface is exposed to an attacker-reachable network. Audit which interfaces and VLANs can reach switch management services today; in many environments this reachability is broader than intended. Review HPE’s advisory for the full list of 24 CVEs fixed in this bulletin, since several of the lower-severity issues may still be relevant to your deployment.

Sources: HPE security bulletin coverage — BleepingComputer, SecurityWeek, CVE-2026-73749 detail — IONIX, technical breakdown — TechTimes