HPE Issues Critical Patch for ArubaOS-CX After Discovery of High‑Severity RCE Flaws

Hewlett Packard Enterprise has released a set of security updates aimed at fixing a cluster of remote‑code‑execution weaknesses in its ArubaOS‑CX network operating system. The vulnerabilities, grouped under the identifier CVE‑2026‑73749, carry a CVSS rating of 9.8, indicating a critical level of risk.

Security researchers uncovered nearly two dozen distinct flaws that were consolidated into the single CVE for tracking purposes. Exploitation could allow an unauthenticated attacker to run arbitrary code on affected switches, potentially compromising the integrity of network traffic and gaining control of the device.

ArubaOS‑CX powers a broad range of HPE networking gear deployed in enterprise data centers, campus environments, and edge locations. Because the operating system governs routing, switching, and policy enforcement, a successful breach could have far‑reaching consequences for any organization that relies on these platforms for core connectivity.

In response, HPE issued patches through its standard support channels and urged customers to apply the updates without delay. The company’s advisory outlines the steps for downloading the firmware, validates the fix, and recommends best‑practice procedures such as testing in a staging environment before broad rollout.

Analysts emphasize that swift remediation is essential given the high severity score and the ease with which the flaws could be leveraged. Enterprises are advised to audit their inventory of ArubaOS‑CX devices, ensure the latest firmware is installed, and consider additional network‑segmentation measures while patches are being deployed. The incident reinforces the ongoing challenge of securing critical infrastructure software and the importance of coordinated vulnerability disclosure.