HPE Patches Critical RCE Vulnerabilities in AOS-CX

Key Points:

• HPE has released patches for 34 CVEs in the ArubaOS-CX platform, addressing critical remote code execution (RCE) vulnerabilities, particularly CVE-2026-73749 with a CVSS score of 9.8.
• The vulnerabilities allow unauthenticated attackers to exploit the system by sending crafted packets, potentially leading to RCE with elevated privileges. Other issues could result in denial-of-service (DoS), privilege escalation, and information disclosure.
• It is recommended to restrict CLI and web-based management interfaces to a dedicated VLAN and implement firewall policies for enhanced security.

Technical Details: The critical RCE vulnerabilities stem from improper processing of malformed input sent to a service within HPE's database-centric operating system for enterprise switches.

MITRE ATT&CK Techniques:

• None mentioned

IOCs Mentioned:

• None mentioned