These Aruba Switches Could Be Taken Over Without a Login
A network switch is supposed to enforce boundaries. HPE has now patched a vulnerability that could let unauthenticated, specially crafted network traffic turn the switch itself into the attacker’s execution environment.
CVE-2026-73749 is a CVSS 9.8 buffer overflow in an ArubaOS-CX daemon. HPE says a remote attacker can send specially crafted packets to the affected service and potentially execute code with elevated privileges. No account and no user interaction are required.
It is the most urgent flaw in a much larger September bulletin. HPE disclosed 34 CVEs across the AOS-CX operating system, management interface, API and command-line components. Five score 8.8, and two of those can be reached without authentication from an adjacent network. The group includes command injection, arbitrary file write, authentication bypass, privilege escalation, information disclosure and denial of service.
HPE says it was not aware of public discussion or exploit code targeting the listed vulnerabilities as of the advisory’s release. The company nevertheless provides fixes rather than a complete workaround. Segmentation of management access can reduce exposure, but it does not remove the packet-processing flaws.
The critical flaw starts before authentication
The attack path for CVE-2026-73749 is unusually direct. The attacker sends malformed network traffic to a vulnerable daemon. HPE’s CVSS vector says the attack is remote, low complexity, requires no privileges and needs no user interaction. Successful exploitation can affect confidentiality, integrity and availability.
For a switch, elevated code execution is more than another compromised server. The device sits inside traffic flows, segmentation plans and administrative networks. Control of its operating system can undermine assumptions made by systems on both sides of it.
Two additional 8.8-rated flaws deserve special attention. CVE-2026-73752 permits an unauthenticated attacker on an adjacent network to write arbitrary files through an API endpoint, potentially leading to code execution. CVE-2026-73782 is an unauthenticated format-string vulnerability in the command-line interface that can execute code as a privileged user from an adjacent network.
Which releases are affected?
| Release branch | Affected | Fixed release |
|---|---|---|
| AOS-CX 10.18 | 10.18.0001 and earlier | 10.18.1002 or later |
| AOS-CX 10.17 | 10.17.1021 and earlier | 10.17.1030 or later |
| AOS-CX 10.16 | 10.16.1051 and earlier | 10.16.1060 or later |
| AOS-CX 10.13 | 10.13.1180 and earlier | 10.13.1190 or later |
| AOS-CX 10.10 | 10.10.1180 and earlier | 10.10.1181 or later |
The 10.10 branch has reached end of maintenance. HPE says end-of-maintenance products are presumed affected unless explicitly excluded and are not completely addressed by the bulletin. Releases past end of support were not assessed and should be treated as potentially affected. Moving to a supported branch is the safer response.
Every CVE in the HPE bulletin
The table below keeps every vulnerability separate. The affected and fixed versions are the same across the bulletin. HPE’s recommended mitigation for all entries is to restrict CLI and web management to a dedicated Layer 2 segment or VLAN and enforce Layer 3 firewall controls, with accounting and logging. HPE says it was not aware of public discussion or exploit code targeting the listed vulnerabilities as of the advisory’s release.
| CVE | Score | Prerequisite | Impact |
|---|---|---|---|
| CVE-2026-73749 | 9.8 | Remote, unauthenticated, no interaction | Crafted packets trigger a daemon buffer overflow and elevated code execution. |
| CVE-2026-73750 | 8.8 | Remote, low-privilege account, hostile authentication server | Malformed authentication input can cause denial of service or elevated code execution. |
| CVE-2026-73751 | 8.8 | Remote, low-privilege account | Crafted web-management input executes operating-system commands. |
| CVE-2026-73752 | 8.8 | Adjacent network, unauthenticated | An API endpoint permits arbitrary file write and possible code execution. |
| CVE-2026-73753 | 8.8 | Remote, low-privilege account | Affected CLI operations permit commands as a privileged operating-system user. |
| CVE-2026-73782 | 8.8 | Adjacent network, unauthenticated | A CLI format-string flaw permits privileged code execution. |
| CVE-2026-73781 | 8.4 | Remote admin account plus administrator interaction | Stored cross-site scripting runs code in an administrator’s browser session. |
| CVE-2026-73780 | 8.3 | Unauthenticated, requires an authenticated user to open a crafted URL | Missing CSRF protection can submit arbitrary input in certificate-authenticated sessions. |
| CVE-2026-73779 | 8.2 | Adjacent network, unauthenticated | Authentication bypass can expose information, change resources and disrupt services. |
| CVE-2026-73778 | 8.1 | Remote, unauthenticated, factory-default or post-ZTP state | A predictable default password can provide full administrative control before credentials are configured. |
| CVE-2026-73777 | 8.1 | Remote, unauthenticated | API authorization bypass can circumvent access controls and elevate privileges. |
| CVE-2026-73776 | 7.9 | Local administrator plus additional preconditions | A signature-verification bypass can lead to arbitrary operating-system code execution. |
| CVE-2026-73775 | 7.7 | Remote, low-privilege account | API flaws disclose sensitive information that could enable further access. |
| CVE-2026-73774 | 7.6 | Adjacent network, unauthenticated | Crafted packets trigger a buffer overflow with limited disclosure, modification and disruption. |
| CVE-2026-73773 | 7.5 | Remote, unauthenticated | An API request can interrupt the affected service. |
| CVE-2026-73771 | 7.5 | Remote, unauthenticated, specific conditions and user interaction | Improper authentication handling can provide unauthorised access or exhaust resources. |
| CVE-2026-73770 | 7.3 | Adjacent network, administrator, external preconditions and another user’s action | Arbitrary file write can lead to privileged command execution. |
| CVE-2026-73768 | 7.3 | Local low-privilege user plus interaction | Malformed CLI input can execute commands with root privileges. |
| CVE-2026-73767 | 7.2 | Remote administrator | CLI command injection executes arbitrary commands as a privileged user. |
| CVE-2026-73766 | 7.2 | Remote administrator | API command injection executes arbitrary privileged operating-system commands. |
| CVE-2026-73765 | 7.2 | Remote administrator | API path traversal permits arbitrary file write and possible code execution. |
| CVE-2026-73764 | 7.1 | Adjacent network, unauthenticated | Authentication bypass enables resource modification and limited service disruption. |
| CVE-2026-73763 | 7.1 | Adjacent network, unauthenticated, high complexity | A management component can execute commands in the affected utility’s context. |
| CVE-2026-73762 | 6.6 | Remote administrator | API authorization bypass exposes restricted management functionality. |
| CVE-2026-73772 | 6.5 | Adjacent network, unauthenticated | Crafted packets trigger buffer overflows and denial of service. |
| CVE-2026-73761 | 6.5 | Adjacent network, unauthenticated | An out-of-bounds read exposes sensitive operating-system information. |
| CVE-2026-73759 | 6.5 | Adjacent network, unauthenticated | Crafted packets can disrupt normal device operation. |
| CVE-2026-73760 | 6.5 | Remote, low-privilege account | Path traversal exposes arbitrary files through web management. |
| CVE-2026-73758 | 6.5 | Remote, low-privilege account | Broken API access control lets an operator change protected settings. |
| CVE-2026-73757 | 6.4 | Remote, low-privilege account | Web-management SSRF can expose the host’s internal structure and allow limited modification. |
| CVE-2026-73756 | 5.9 | Remote, unauthenticated, man-in-the-middle position | An API weakness can disclose sensitive information. |
| CVE-2026-73755 | 5.7 | Remote, low-privilege account plus user action | Session information disclosure can support privilege escalation. |
| CVE-2026-73754 | 5.3 | Remote, low-privilege account | CLI requests can disrupt normal operation. |
| CVE-2026-73783 | 4.9 | Remote administrator | An API stack overflow causes denial of service. |
Segmentation helps, but the switch still needs the patch
HPE recommends keeping CLI and web management on a dedicated VLAN or Layer 2 segment and controlling access with firewalls at Layer 3 and above. That guidance is valuable for the management-plane vulnerabilities and should already be normal practice.
It is not a substitute for upgrading. The critical daemon flaw is triggered by crafted packets sent to the affected service, while several other vulnerabilities operate from an adjacent network or during initial provisioning. A management interface that is not exposed to the public internet can still be reachable from a compromised workstation, monitoring platform, jump host or neighbouring network segment.
Teams should inventory switch software versions, identify end-of-maintenance and end-of-support branches, and verify the running image after maintenance. Backups and change plans are important, but so is checking that the device actually booted the fixed image rather than retaining a vulnerable fallback.
What defenders should do now
- Upgrade to 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 or 10.10.1181 as applicable.
- Move end-of-support installations to a supported release rather than assuming the bulletin clears them.
- Restrict CLI, web and API access to dedicated management segments and authorised administration hosts.
- Review firewall rules for accidental access from user, guest, wireless and third-party networks.
- Audit factory-default and post-ZTP processes, where predictable credentials create a separate takeover path.
- Monitor management services for malformed traffic, unusual restarts, new accounts, configuration changes and unexpected outbound connections.
- Verify the installed image and running version after the maintenance window.
The control plane is part of the security perimeter
Switches are sometimes patched more slowly than servers because they are seen as stable appliances whose exposure is limited to internal networks. This bulletin shows why that assumption is dangerous. A vulnerable switch is not only another endpoint. It can sit underneath the controls used to isolate other endpoints.
The absence of reported exploitation is useful context, not a reason to defer. HPE has documented an unauthenticated network path to elevated code execution and supplied fixed releases. Defenders now have a clear choice between a scheduled upgrade and an attacker choosing the timing for them.
Sources and further reading
- HPE Networking security bulletin HPESBNW05134, released 1 September 2026 and updated 2 September 2026. The machine-readable advisory records 1 September at 16:00 UTC.
- HPE CSAF advisory for HPESBNW05134, containing all 34 CVE records, affected products, scores and remediation guidance.
- BleepingComputer report on the ArubaOS-CX fixes, published 3 September 2026 at 14:28 in the publisher’s displayed timezone.
