CVE-2026-73749 (CVSS 3.1 base score 9.8, Critical) affects a network-facing daemon in HPE Aruba Networking AOS-CX that improperly processes malformed input. An unauthenticated remote attacker can send specially crafted packets to the affected service, with no privileges or user interaction required, resulting in remote code execution with elevated privileges on the switch.

CVE-2026-73749 was disclosed on 1 September 2026 alongside related AOS-CX vulnerabilities (including CVE-2026-73782 and CVE-2026-73783) in the same HPE security bulletin; this advisory covers CVE-2026-73749 specifically. Because AOS-CX runs the core switching and routing function of the network devices it operates on, remote code execution at elevated privilege on an affected switch can expose the traffic and segments that switch carries, not just the device itself.

• HPE Aruba Networking AOS-CX 10.18.0000, 10.17.0000, 10.16.0000, 10.13.0000, and 10.10.0000 trains (and earlier builds within each train) – Affected

See HPE Security Bulletin HPESBNW05134 for the specific fixed build on each AOS-CX train – Not affected, patched.

CERTVU advises verifying HPE's public bulletin (docId HPESBNW05134) as the authoritative source for the exact fixed build number on each affected AOS-CX train. Patching is critical.

Typical attack flow:

• Step 1 - Reach the Affected AOS-CX Daemon An attacker identifies a switch running an affected HPE Aruba Networking AOS-CX build with the vulnerable daemon reachable over the network.
• Step 2 - Send Malformed Input to Trigger Remote Code Execution The attacker sends specially crafted packets that the daemon fails to process correctly, triggering remote code execution with elevated privileges on the switch, with no authentication or user interaction required.

Attack vectors:

• Direct network access to the affected AOS-CX daemon on the switch — no authentication, prior access, or user interaction is required.
• Particular risk where AOS-CX switch management or service interfaces are reachable from outside a trusted management network or the internet.

Successful exploitation may allow attackers to:

• Execute arbitrary code with elevated privileges on the affected switch.
• Gain control of a core network device, with potential impact on the confidentiality, integrity, and availability of every network segment that switch carries.

CERTVU recommends the following:

1. Apply the HPE Fix Without Delay
   • Consult HPE Security Bulletin HPESBNW05134 for the specific fixed build for each affected AOS-CX train and apply it as a priority, given the maximum CVSS score and lack of any exploitation precondition.
2. Restrict network exposure of AOS-CX management and service interfaces.
3. Segment and monitor switch management traffic pending patching.
4. Audit the estate for the affected product.
5. Conduct a compromise assessment.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.