Affected Systems
ArubaOS-CX network operating system on HPE Aruba enterprise switches. Affected versions: 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, 10.10.1180 and earlier. Used in large enterprises, government, healthcare, data centers, and service providers.
Exploitation Status
No active exploitation or public proof-of-concept known at time of vendor disclosure. HPE states they are not aware of exploitation targeting CVE-2026-73749 or the 23 additional vulnerabilities patched in the same bulletin.
Business Impact
CVE-2026-73749 is a buffer overflow allowing unauthenticated remote attackers to execute arbitrary code with elevated privileges by sending crafted packets to an affected daemon. This represents full system compromise of critical network infrastructure. Additional 23 vulnerabilities (some rated 8.1-8.8) include adjacent-network RCE, authentication bypass, command injection, and default credential issues. Exploitation could enable lateral movement, network disruption, and persistent access to enterprise switching infrastructure.
Urgency
🟡 Within a week
Recommended Actions
- Identify all HPE Aruba switches running ArubaOS-CX and determine current version using 'show version' command
- Upgrade to patched versions: 10.18.1002+, 10.17.1030+, 10.16.1060+, 10.13.1190+, or 10.10.1181+ based on current release branch
- Review network segmentation to ensure ArubaOS-CX management interfaces are not exposed to untrusted networks or the internet
- Audit ArubaOS-CX devices for factory-default credentials and ensure all devices have been properly configured with strong administrative passwords (addresses CVE-2026-73778)
- Monitor ArubaOS-CX switch logs for unusual daemon crashes, unexpected authentication attempts, or anomalous API activity