HPE patches unauthenticated RCE flaw in ArubaOS-CX (CVE-2026-73749)

What happened

HPE has shipped patches for a set of buffer overflow vulnerabilities in ArubaOS-CX, the operating system that runs on its Aruba network switches. According to a BleepingComputer report from September 3, 2026, relayed in a dev.to analysis, the flaws stem from improper input handling inside system daemons and allow an unauthenticated remote attacker to execute arbitrary code with high privileges on an affected device. HPE disclosed the issue under advisory HPESBNW05134, tracked as CVE-2026-73749.

The advisory covers multiple release trains: ArubaOS-CX 10.18, 10.17, 10.16, 10.13 and 10.10, with fixes available per train. Notably, the public disclosure does not name the vulnerable daemon, the protocol involved, or the port it listens on, a gap that makes precisely targeted network detection harder.

How exploitation would work

The dev.to writeup is careful to frame the attack flow as inferred from the disclosure rather than observed in the wild, and no active exploitation is documented in the source material. In the assumed flow, an attacker who can reach the affected service sends crafted packets to the target daemon. Improper input handling allows that input to overflow a buffer, and if exploitation succeeds, the attacker gains arbitrary code execution with high privileges on the switch. No user interaction is required.

One boundary the writeup draws repeatedly: a daemon crash or memory corruption on its own does not demonstrate successful code execution. Reachability and crashes are signals to investigate, not proof of compromise.

Success depends on a vulnerable version running, the attacker being able to reach the service without IPS, ACL or comparable controls interfering, and the input handling flaw actually being leveraged into execution rather than merely crashing the process.

Mitigation guidance

Patching to the fixed release for the applicable train is the definitive remedy. As a temporary measure, HPE recommends restricting CLI and web management access to dedicated Layer 2 segments or VLANs, or shielding management with Layer 3 and above firewall policies, together with monitoring of user actions and resource usage. The dev.to analysis adds, as its own inference, that control-plane policing and anomalous traffic monitoring are useful supplements but no substitute for installing the update.

What defenders should look for

Because endpoint EDR products do not instrument network hardware, the writeup points to device-level evidence: crash logs and reboot histories where the device is configured to record them, core dumps, suspicious files, and newly added local accounts or keys. On the network side, abnormal packets aimed at the affected service and outbound connections from the switch to unknown destinations warrant investigation. Configuration diffs showing unusual ACL or routing changes, and administrative logs listing unfamiliar source addresses, are also flagged. None of these observations alone confirms an attack, and the writeup urges separating scans, crashes, code execution and configuration tampering into distinct assessment categories during investigation.

Why it matters

A pre-authentication, network-reachable code execution flaw in the software running the network fabric is close to a worst case for network operators. Code executing with high privileges on a switch can, as the writeup infers, be used to tamper with ACLs, routing and monitoring settings, redirect or eavesdrop on traffic, or act as a foothold for movement into the internal network. Because the disclosure withholds the daemon, protocol and port, defenders cannot write narrow detection rules, which shifts the practical burden onto reducing management reachability and patching promptly. With five release trains in scope, including older lines such as 10.10 and 10.13, a firmware inventory check is the sensible first step for any environment running ArubaOS-CX.