HPE Aruba AOS-CX: A 9.8 Flaw in the Switch, Not the Firewall

A network switch is not supposed to be the scary device. Firewalls and VPN gateways sit on the internet and take the punches; the switch lives quietly in the comms cupboard behind them. So it is worth pausing on what HPE published on 1 September 2026: security bulletin HPESBNW05134 for its AOS-CX switch software, headlined by CVE-2026-73749, a cluster of buffer-overflow bugs in a switch daemon that lets an attacker with no login at all send crafted packets and run their own code on the switch with elevated privileges. HPE rates it CVSS 9.8, and the vector confirms the worst case: network-reachable, low complexity, no credentials, no user interaction. If your business runs HPE Aruba Networking CX switches, this is the fortnight to check what firmware they are on.

What happened, in plain English

HPE's bulletin is a big one. It fixes 34 CVEs in AOS-CX, the operating system on HPE Aruba Networking's CX switch range, and almost all of them were found by HPE's own internal security research rather than by an outside party. The headline item and the ones worth understanding:

• CVE-2026-73749 (CVSS 9.8, Critical). HPE describes it as multiple vulnerabilities in "a daemon of ArubaOS-CX" that mishandle malformed input. An unauthenticated remote attacker sends specially crafted packets to the service and gets remote code execution with elevated privileges. The CVE bundles nineteen separate internal findings into one identifier, which is why some outlets describe it as "nearly two dozen bugs". HPE has not named the daemon publicly.
• CVE-2026-73752 and CVE-2026-73782 (both CVSS 8.8). Two more paths to unauthenticated code execution: an arbitrary file write through an API endpoint, and a format-string bug in the command-line interface. Here is the nuance the headlines skip: both are rated adjacent-network in the CVSS vector, meaning the attacker needs to be on the same network segment as the switch, not anywhere on the internet. Still serious, but a different threat model from the 9.8.
• CVE-2026-73778 (CVSS 8.1). A switch in its factory-default or post-zero-touch-provisioning state accepts a predictable factory-default password, giving full admin control to whoever reaches it first during initial setup. It only bites before an administrator has configured credentials, but that window is exactly when new gear is most likely to be plugged in and forgotten for a day.
• The remaining thirty-odd CVEs are a mix of authenticated command injections, authentication bypasses, path traversals, information disclosures and denial-of-service bugs. Most need a login of some kind, and we will not walk through each one.

Affected versions are AOS-CX 10.18.0001, 10.17.1021 and below, 10.16.1051 and below, 10.13.1180 and below, and 10.10.1180 and below. Fixed versions are 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 and 10.10.1181, each "and above". Two honest footnotes from the bulletin itself: the 10.10 branch is End of Maintenance, so HPE fixed only the critical findings there and nothing else; and for anything past End of Support, HPE says it has not assessed exposure at all and you should treat the device as potentially affected. The bulletin scopes by software version, not by model: if it runs AOS-CX, it is in scope.

Is it being exploited? Not that anyone can confirm. HPE told reporters it is not aware of active exploitation or public proof-of-concept code, and as of 4 September the flaws are not on CISA's Known Exploited Vulnerabilities catalogue. That is good news, and also the normal state of affairs in the week after a patch drops, so treat it as a head start rather than a reason to wait.

One scoping note for readers of our cloud-managed networking comparison: HPE's bulletin states that HPE Networking products not listed are not affected. The Aruba Instant On switches many small offices buy do not run AOS-CX, so this bulletin is about the CX line, not Instant On.

Why it matters: the "inside" is not a safe zone

Most security advice for small business quietly assumes the dangerous devices are the ones facing the internet. Patch the firewall, lock down the VPN, and the switch behind them can take care of itself. This bulletin is a reminder that the assumption has limits.

A switch's management daemons listen on the network. If an attacker gets a foothold anywhere inside, through a phished laptop, a compromised printer, a contractor's device on the wrong VLAN, a flaw like CVE-2026-73749 turns that foothold into control of the device every other device talks through. From the switch you can mirror traffic, re-route it, or simply switch the office off. And because switches are rarely internet-facing, they are rarely watched, inventoried or patched. We have written before about what happens to gear nobody remembers. Switches are the most forgettable gear of all.

The factory-default password bug points at a second pattern we have covered in the TP-Link Omada zero-touch flaws: the conveniences that make gear easy to deploy are also the moments it is least defended. A new switch racked on Friday and configured on Monday has spent a weekend accepting a guessable password from anyone on the network.

The honest bit

No vendor is immune, including the ones we like. We sell and recommend Cisco and Meraki gear, and Cisco has had its own large batch of switch-OS flaws this year, as has Ubiquiti. Thirty-four CVEs in one bulletin sounds alarming, but read it the other way: HPE's own researchers went looking, found them, and published the lot with fixes and CVSS vectors that are honest about which bugs need a login and which need to be on the same network. That is what responsible handling looks like, and it is a better outcome than a smaller bulletin written after someone else found the 9.8 first.

One genuine difference worth stating as advice rather than a pitch: on cloud-managed platforms, whether that is Cisco Meraki or HPE's own Instant On line, firmware fixes are scheduled and pushed by the vendor rather than waiting for someone to log into each switch. We have written about why that model keeps improving after purchase. Traditionally managed switches like the CX line are excellent kit, but they put the patching calendar on you, and this is a bulletin where the calendar matters.

What we'd suggest you actually do

1. Find your AOS-CX switches and read the version off each one. Compare against the fixed list: 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 or 10.10.1181 and above. If you do not know what switch is in the cupboard, that is the first job.
2. Schedule the upgrade. Fixed software is on the HPE Networking Support Portal. A switch upgrade means a short outage, so plan a window, but do not let "we need a window" turn into "next quarter". The 9.8 needs no credentials.
3. If you are on the 10.10 branch, plan a move off it. HPE fixed only the critical items there and will not fix the rest. Anything past End of Support has not been assessed at all, and the Cisco RV story shows where unsupported gear ends up.
4. Put switch management on its own VLAN. Management interfaces and APIs should be reachable only from an admin network or specific addresses, never from the general staff or guest network, and never from the internet. This is the single control that shrinks both the 9.8 and the adjacent-network bugs.
5. Never leave new gear at factory defaults, even overnight. Set admin credentials the moment a switch is powered on, or stage it on an isolated bench network until it is configured.
6. Do the basics everywhere. Unique administrator passwords, multi-factor authentication where the platform supports it, and a subscription to your vendors' security bulletins so the next one of these reaches you the day it lands. Our FortiBleed explainer covers why credential hygiene outlasts any single patch.

The friendly takeaway

This is not an "HPE bad" story. It is a reminder that the quiet switch behind your firewall runs software too, that software has bugs, and that in this case one of them is about as bad as bugs get. Nothing suggests it is being exploited yet, which makes this the easy version of the problem: check your versions, book an upgrade, and tidy up the management network while you are at it.

As always, this post is part of us keeping watch so you don't have to. If you would like a second pair of eyes over what is actually in your comms cupboard, what firmware it runs, and which bits are quietly out of support, get in touch. No obligation, no hard sell; sometimes a quick look is all it takes.

References

• HPE Security Bulletin HPESBNW05134 rev.1 — Multiple Vulnerabilities in HPE Aruba Networking ArubaOS-CX (AOS-CX)
• NVD — CVE-2026-73749 (unauthenticated buffer overflows, RCE, CVSS 9.8)
• NVD — CVE-2026-73752 (unauthenticated arbitrary file write, adjacent network, CVSS 8.8)
• NVD — CVE-2026-73782 (unauthenticated format string in CLI, adjacent network, CVSS 8.8)
• NVD — CVE-2026-73778 (predictable factory-default password, CVSS 8.1)
• CISA — Known Exploited Vulnerabilities Catalog (checked 4 September 2026: no AOS-CX entries)
• BleepingComputer — HPE patches critical ArubaOS-CX remote code execution flaw
• SecurityWeek — HPE Patches Critical RCE Vulnerabilities in AOS-CX