HPE Patches Critical RCE Vulnerabilities in AOS CX

What is AOS CX and why it matters

AOS CX is HPE's operating system for its Aruba networking devices. It powers switches, routers and edge platforms that many enterprises rely on for day to day connectivity. Because the software runs at the core of network traffic, any weakness can affect large segments of an organization’s infrastructure.

Key components of the platform

The system includes a command line interface, a REST API and a set of services that manage routing, switching and security policies. All of these components share common libraries, which means a flaw in one area can potentially be leveraged across multiple functions.

Details of the CVE-2026-73749 vulnerabilities

Security researchers discovered nearly two dozen issues that were later grouped under the identifier CVE-2026-73749. The vulnerabilities allow an unauthenticated attacker to execute arbitrary code on affected devices. The combined CVSS score of 9.8 classifies them as critical.

Attack vector and impact

Each flaw resides in a different module of the operating system, but they share a common exploitation path. An attacker can send specially crafted network packets to a vulnerable device, trigger a buffer overflow, and gain shell access with root privileges. Once the attacker controls the device, they can intercept traffic, modify configurations or use the platform as a foothold for further lateral movement.

Remote code execution without user interaction
Potential for data exfiltration across the network
Ability to disrupt critical services by altering routing tables

HPE’s response and patch rollout

HPE published an advisory that outlines the affected firmware versions and provides a set of patches that address each of the identified flaws. The patches were made available through the HPE security advisory portal and can be downloaded from the official support site.

Patch deployment guidance

HPE recommends the following steps for a safe rollout:

Verify the current firmware version on each device using the CLI command show version.
Back up the existing configuration and store it in a secure location.
Download the appropriate patch package that matches the device model and firmware baseline.
Apply the patch during a maintenance window to minimise impact on users.
Reboot the device if the advisory specifies a restart is required.
Run a post‑install validation script to confirm that the vulnerabilities are closed.

For organizations that manage large fleets of Aruba devices, HPE suggests using the CISA NCAS tool to automate inventory checks and ensure compliance across the network.

Impact on organizations and mitigation steps

Enterprises that have not yet applied the patches remain exposed to remote exploitation. The risk is especially high for environments that expose management interfaces to the internet or that allow untrusted VLANs to reach the control plane.

Best practices for patch management

Beyond the immediate HPE patches, security teams should adopt a broader set of controls:

Maintain an up to date asset inventory that includes firmware versions.
Enforce network segmentation to isolate management traffic from data traffic.
Enable multi‑factor authentication for any administrative access.
Monitor logs for unusual API calls or configuration changes.
Subscribe to vendor security feeds to receive timely alerts.

Implementing these measures reduces the attack surface and improves the organization’s ability to respond to future vulnerabilities.

Industry reaction and future outlook

The disclosure of CVE-2026-73749 has been covered by several security outlets, including NIST NVD and the MITRE CVE record. Analysts note that the concentration of multiple flaws in a single product line underscores the need for continuous code review and rigorous testing.

Looking ahead, HPE has pledged to increase the frequency of its security updates and to provide more detailed remediation guidance. The company also plans to enhance its bug bounty program to encourage external researchers to report vulnerabilities before they are exploited in the wild.

For security professionals, the episode serves as a reminder that even well established networking platforms can harbor critical bugs. Regular patching, vigilant monitoring and a proactive security posture remain the most effective defenses against remote code execution threats.