# HPE Patches Critical ArubaOS-CX Buffer Overflow (CVE-2026-73749) Enabling Unauthenticated Remote Code Execution

> HPE disclosed and patched CVE-2026-73749 (CVSS 9.8), a critical buffer overflow in a daemon of ArubaOS-CX that lets an unauthenticated remote attacker send specially crafted packets to trigger memory corruption and achieve remote code execution with elevated privileges on Aruba CX-series switches. The flaw was released alongside a batch of related AOS-CX vulnerabilities (CVE-2026-73750 through CVE-2026-73782, CVSS 8.1-8.8) in HPE advisory hpesbnw05134en_us on September 1, 2026; HPE reported no known public proof-of-concept or active exploitation at disclosure.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-06T13:19:42.913Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2314
- **ID:** TL-2026-2314
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-73749, CVE-2026-73750, CVE-2026-73751, CVE-2026-73752, CVE-2026-73753, CVE-2026-73777, CVE-2026-73778, CVE-2026-73779, CVE-2026-73780, CVE-2026-73781, CVE-2026-73782

## Description

On September 1, 2026, Hewlett Packard Enterprise (HPE) Networking published security advisory hpesbnw05134en_us disclosing CVE-2026-73749, a critical (CVSS v3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) buffer-overflow vulnerability affecting a daemon within ArubaOS-CX, the operating system used on HPE Aruba Networking's CX-series campus and data-center switches. According to the advisory description, multiple vulnerabilities exist in the affected daemon that allow improper processing of malformed input; an unauthenticated remote attacker can send specially crafted packets to the affected service to corrupt memory and achieve remote code execution with elevated privileges. Because the flaw requires no authentication, no privileges, and no user interaction (PR:N/UI:N) and is reachable over the network (AV:N), it presents an unauthenticated, pre-auth remote takeover path against core network switching infrastructure. HPE has not disclosed which specific daemon or network port is affected; no HPE advisory, NVD record, or independent research write-up reviewed identifies the process name, listening port, or protocol beyond the general description of 'specially crafted packets' sent to 'the affected service.'

The vulnerability spans five parallel AOS-CX release branches: 10.18.0001 and earlier, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, and 10.10.1180 and earlier. HPE shipped fixed builds for each branch (10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181 respectively).

The same advisory batch discloses additional AOS-CX vulnerabilities in the CVE-2026-73750 to CVE-2026-73782 range, each independently confirmed with its own CVSS vector, CWE, and attack requirements: CVE-2026-73750 (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) — malformed/truncated input processed by the authentication module, exploitable by an authenticated attacker relaying crafted data from a compromised or hostile authentication server, causing DoS or elevated-privilege RCE, CWE-284; CVE-2026-73751 (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) — a low-privileged authenticated user submitting crafted input through the web-based management interface to execute arbitrary OS commands; CVE-2026-73752 (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) — an unauthenticated, adjacent-network attacker exploiting a path-traversal flaw (CWE-22) in an API endpoint to write arbitrary files to the underlying OS, enabling RCE; CVE-2026-73753 (CVSS 8.8) — an authenticated low-privileged user abusing command-line operations to execute arbitrary commands as a privileged user; CVE-2026-73778 (CVSS 8.1) — the Credential Manager component shipping a predictable factory-default/post-ZTP password, letting an unauthenticated remote attacker gain full administrative access to a device that has not yet been configured by an administrator; CVE-2026-73779 (CVSS 8.2, adjacent/remote unauthenticated) — an authentication-bypass flaw in the AOS-CX operating system letting an unauthenticated remote actor circumvent existing authentication controls; and CVE-2026-73782 (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) — a format-string vulnerability in the CLI reachable by an adjacent-network unauthenticated attacker, enabling arbitrary code execution as a privileged user. At the time of disclosure HPE stated it was not aware of any public discussion, proof-of-concept code, or exploitation of CVE-2026-73749 in the wild, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of September 3, 2026.

This September 2026 batch (CVE-2026-73749/7375x/7378x) is a separate, later HPE Aruba Networking AOS-CX disclosure from the March 2026 CVE-2026-23813 through CVE-2026-23817 authentication-bypass/command-injection batch (advisory ~March 5-10, 2026, tracked separately by CSA Singapore AL-2026-023, SecurityAffairs, and Field Effect); the two batches affect overlapping AOS-CX version lines but are independent vulnerability sets and are not conflated here.

ArubaOS-CX switches are widely deployed as enterprise campus and data-center switching infrastructure across government agencies, universities, healthcare providers, and financial and data-center environments, making unpatched exposure of switch management/control-plane services to untrusted networks a high-value target for an attacker seeking a foothold or pivot point deep inside a target's network segmentation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1059.004 Command and Scripting Interpreter
- T1078.001 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1499 Endpoint Denial of Service

## Sources

- [HPE patches critical ArubaOS-CX remote code execution flaw](https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/)
- [HPE Support Advisory hpesbnw05134en_us](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US)
- [NVD - CVE-2026-73749 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-73749)
- [CVE-2026-73749: Unauth RCE in HPE Networking AOS-CX Scores 9.8](https://securityonline.info/hpe-aos-cx-cve-2026-73749-rce/)
- [CVE-2026-73749: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX](https://radar.offseq.com/threat/cve-2026-73749-vulnerability-in-hewlett-packard-enterprise-hpe-aos-cx-8a7e83dd53b44029)
- [CVE-2026-73749](https://cve.threatint.com/CVE/CVE-2026-73749)
- [CVE-2026-73750: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX](https://radar.offseq.com/threat/cve-2026-73750-vulnerability-in-hewlett-packard-enterprise-hpe-aos-cx-f22714c49ae144b2)
- [CVE-2026-73752: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX](https://radar.offseq.com/threat/cve-2026-73752-vulnerability-in-hewlett-packard-enterprise-hpe-aos-cx-4389bfd9998e84b0)
- [CVE-2026-73778: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX](https://radar.offseq.com/threat/cve-2026-73778-vulnerability-in-hewlett-packard-enterprise-hpe-aos-cx-36de1874a6928ade)
- [AOS-CX CLI Unauthenticated RCE (CVE-2026-73782)](https://www.thehackerwire.com/aos-cx-cli-unauthenticated-rce-cve-2026-73782/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2314