HPE Patches Critical RCE Vulnerabilities in AOS-CX
HPE released patches addressing 34 CVEs across five AOS-CX versions (10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181), resolving over 150 individual flaws CVE-2026-73749 (CVSS 9.8) consolidates nearly two dozen critical RCE vulnerabilities allowing unauthenticated remote code execution with elevated privileges 22 high-severity CVEs cover DoS, RCE, arbitrary command/script execution, authentication bypass, privilege escalation, and information disclosure 11 medium-severity CVEs involve
Analysis
TL;DR
- HPE released patches addressing 34 CVEs across five AOS-CX versions (10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181), resolving over 150 individual flaws
- CVE-2026-73749 (CVSS 9.8) consolidates nearly two dozen critical RCE vulnerabilities allowing unauthenticated remote code execution with elevated privileges
- 22 high-severity CVEs cover DoS, RCE, arbitrary command/script execution, authentication bypass, privilege escalation, and information disclosure
- 11 medium-severity CVEs involve access control bypass, file reads, DoS, and privilege escalation
- HPE's security team discovered most flaws internally; no active exploitation in the wild has been reported
Why It Matters
This patch release highlights the persistent security risks in enterprise network infrastructure, particularly database-centric operating systems powering critical switching hardware. The unauthenticated RCE vulnerabilities pose significant threats to organizations relying on ArubaOS-CX for network management, as attackers could gain full control of switch infrastructure without credentials.
Technical Details
- Affected Versions: AOS-CX 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181
- Root Cause: Improper processing of malformed input sent to an unnamed service within HPE's database-centric OS for enterprise switches
- Attack Vector: Unauthenticated attackers can send crafted packets to the vulnerable service, achieving RCE with elevated privileges
- Vulnerability Distribution: 1 critical (CVE-2026-73749, CVSS 9.8), 22 high-severity, and 11 medium-severity CVEs
- Mitigation Recommendations: Restrict CLI and web-based management interfaces to dedicated Layer 2 segments/VLANs, enforce firewall policies at Layer 3+, and implement accounting controls for activity tracking and logging
Industry Insight
- Organizations running ArubaOS-CX should prioritize immediate patching, as unauthenticated RCE in network infrastructure can lead to complete network compromise and lateral movement
- The consolidation of nearly two dozen issues under a single CVE (CVE-2026-73749) suggests a systemic architectural weakness in input validation that warrants deeper security review of similar database-centric network OS designs
- Network segmentation and strict access controls for management interfaces should be treated as essential defense-in-depth measures, especially for critical infrastructure components that may not receive timely patches
Disclaimer: The above content is generated by AI and is for reference only.