HPE patches critical ArubaOS-CX remote code execution flaw

Hewlett Packard Enterprise (HPE) has patched a critical buffer overflow vulnerability in ArubaOS-CX, tracked as CVE-2026-73749, which allows unauthenticated remote attackers to execute arbitrary code with elevated privileges by sending specially crafted packets to an affected daemon. Multiple other vulnerabilities were also addressed, including privilege escalation, command execution, and authentication bypass flaws affecting various versions of ArubaOS-CX. HPE recommends customers upgrade to fixed software versions immediately, although no active exploitation has been observed at the time of disclosure.

AI-extracted · verify before operational use