HPE Patches Critical RCE Flaw in ArubaOS-CX Network OS
A critical vulnerability in HPE's network operating system could allow unauthenticated attackers to take full control of affected switches.
Hewlett Packard Enterprise (HPE) has released urgent security patches to address a critical remote code execution (RCE) vulnerability in its ArubaOS-CX network operating system. The flaw allows an unauthenticated attacker to execute arbitrary code on affected devices, potentially granting full system control.
The vulnerability, identified as CVE-2026-73749, has been assigned a CVSS score of 9.8, reflecting its severity and the ease with which it can be exploited. According to BleepingComputer, the flaw enables remote actors to bypass authentication entirely to run unauthorized commands. HPE has urged all administrators to update their systems immediately to mitigate the risk of network compromise.
The Role of ArubaOS-CX
ArubaOS-CX serves as the modern network operating system for HPE's Aruba switching portfolio, which is widely deployed across campus and data center environments. Because this software manages the fundamental routing and switching of data, it operates at a privileged layer of the infrastructure. Vulnerabilities at this level are particularly dangerous because they provide attackers with a strategic foothold, allowing them to move laterally across an entire enterprise network while remaining undetected by standard endpoint security tools.
Infrastructure Implications
Because network switches act as the backbone of corporate infrastructure, an RCE flaw of this magnitude poses a systemic risk. An attacker who successfully exploits CVE-2026-73749 could intercept sensitive data traffic, redirect network flows to malicious servers, or disable connectivity entirely to cause widespread operational outages. By compromising the switch itself, an adversary can effectively bypass traditional firewalls and antivirus software that typically protect individual workstations and servers.
Next Steps for Administrators
Organizations using ArubaOS-CX should prioritize the deployment of the latest HPE patches. Security teams are advised to audit their network hardware to identify all affected versions and verify that the updates have been successfully applied. While HPE has provided the fix, administrators should also monitor for unusual management traffic or unauthorized configuration changes that may indicate an attempted exploitation prior to patching.