HPE patches critical flaw in Aruba network switches that lets attackers take over without a password
A buffer overflow in ArubaOS-CX, tracked as CVE-2026-73749, lets unauthenticated attackers run code on switches used by hospitals, universities and data centres.
Key points
- Hewlett Packard Enterprise has patched a critical flaw, CVE-2026-73749, in ArubaOS-CX, the software that runs its enterprise network switches.
- The bug lets an attacker on the network take control of a switch without needing a username or password.
- HPE fixed 24 vulnerabilities in the same bulletin, including a factory-default password issue that hands over full admin control.
- No active exploitation or public proof-of-concept exists yet, according to HPE.
- Admins are told to upgrade to fixed builds across the 10.10, 10.13, 10.16, 10.17 and 10.18 branches.
HPE has pushed fixes for a critical bug in ArubaOS-CX, the operating system inside its Aruba network switches. Those switches are the boxes that move traffic around inside offices, hospitals, universities and data centres. If one gets taken over, the attacker is sitting inside the plumbing of the network.
The headline flaw is CVE-2026-73749, a buffer overflow, meaning the switch's software can be tricked into accepting more data than it expects and running whatever the attacker sends next. No login is required. The attacker just needs to reach the vulnerable service over the network.
HPE's own bulletin, first flagged by BleepingComputer, describes it as "improper processing of malformed input" in one of the daemons, the small background programs the switch runs constantly. In practice, that is vendor language for: send the right ugly packet, get code execution as a high-privilege user.
Which versions are fixed?
Upgrade now if you run any of the affected release branches. The 10.10 branch is on End of Maintenance, which usually means no more fixes, but HPE made an exception here because the bug is critical.
| Affected branch | Fixed in |
|---|---|
| 10.18.0001 | 10.18.1002 or later |
| 10.17.1021 and earlier | 10.17.1030 or later |
| 10.16.1051 and earlier | 10.16.1060 or later |
| 10.13.1180 and earlier | 10.13.1190 or later |
| 10.10.1180 and earlier | 10.10.1181 |
What else is in the bulletin?
The same advisory covers 23 more bugs, several rated high severity. A few stand out for anyone running Aruba gear in production.
One is CVE-2026-73778, a predictable factory-default password. A switch left in its out-of-the-box state, or fresh from Zero Touch Provisioning (the automated setup process), can be fully taken over by anyone who can reach it. The failure mode here is the classic one: a switch gets racked, cabled, and forgotten before anyone sets a real password.
Another is CVE-2026-73752, where an attacker on the same local network can write files onto the switch through an API, the software interface other programs talk to. That is a straight path to remote code execution.
There is also CVE-2026-73779, an authentication bypass reachable from an adjacent network. Translation: someone already on your Wi-Fi or a neighbouring VLAN can walk past the login screen.
Should ordinary people worry?
Not directly. These bugs live inside networking gear that sits in server rooms, not on your phone or laptop. The risk is second-hand: if a hospital, university or bank gets its internal network taken over, the fallout eventually reaches patients, students and customers. There is nothing an end user can do here. This one is on the network team.
HPE says it has not seen exploitation in the wild, and no public proof-of-concept exists yet. That window tends to close fast once advisories go out and researchers start diffing the patched binaries against the old ones.
One thing the post-mortem will say, if anyone gets hit before patching: the switch was reachable from somewhere it should not have been.
Patch the switches, then check what can talk to their management interfaces at all.
