Loading story…
HPE Aruba Networking has patched CVE-2026-73749, a critical buffer-overflow flaw in ArubaOS-CX that lets an unauthenticated remote attacker send crafted packets to a vulnerable daemon and execute code with elevated privileges on affected CX-series switches. Fixed releases include AOS-CX 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181; the 10.10.x branch is end of support and receives limited remediation.
The associated security bulletin also addresses 23 additional flaws, including command execution, arbitrary file write, authentication-bypass, privilege-escalation, denial-of-service, stored-XSS, CSRF, and predictable-default-password issues. HPE reports no known exploitation or public proof-of-concept for the disclosed vulnerabilities, but administrators should promptly upgrade to supported fixed releases; where patching is delayed, restrict management web-interface access to approved IP addresses.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
HPE disclosed and released fixes for CVE-2026-73749, a critical unauthenticated remote code-execution flaw, along with 23 additional ArubaOS-CX vulnerabilities affecting enterprise switches. Fixed releases include AOS-CX 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and the limited-maintenance 10.10.1181 release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceacn.gov.it
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcesocradar.io
Open sourcebleepingcomputer.com
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HPE released security updates for Aruba Networking AOS-CX to fix multiple vulnerabilities, including **CVE-2026-23813**, a critical flaw in the web management interface that can let a remote, unauthenticated attacker bypass authentication. In some cases, successful exploitation can also reset an administrator password and lead to full system compromise. The issue carries a **CVSS 3.1 score of 9.8** and affects several release trains, including `10.17.0001` and earlier, `10.16.1020` and earlier, `10.13.1160` and earlier, and `10.10.1170` and earlier. HPE advised customers to upgrade to fixed AOS-CX versions as soon as possible and published mitigation guidance for environments that cannot patch immediately. Recommended steps include restricting access to the management interface, disabling unnecessary HTTP(S) exposure on SVIs and routed ports, applying Control Plane ACLs for REST and HTTP management traffic, and enabling logging and continuous monitoring to detect exploitation attempts against Aruba CX switches.
Jul 24, 2026
Hewlett Packard Enterprise (**HPE Aruba Networking**) disclosed and patched multiple high-severity vulnerabilities affecting *Aruba Networking Instant On* access points/routers, warning that devices running software `3.3.1.0` and earlier are exposed to **information disclosure** and **denial-of-service (DoS)** conditions. The most notable issues include **CVE-2025-37165** (CVSS 7.5), which can expose VLAN and other internal network configuration details via unintended interfaces when operating in router mode, and **CVE-2025-37166** (CVSS 7.5), where specially crafted packets can drive devices into a non-responsive state that may require a hard reset to restore service. HPE also addressed kernel-level packet-processing weaknesses (**CVE-2023-52340** and **CVE-2022-48839**) tied to IPv4/IPv6 handling that can lead to memory corruption and service disruption. Separately, HPE Aruba issued an advisory for **ArubaOS AOS-8 and AOS-10** used by Mobility Conductors, Controllers, and Gateways, patching a broader set of vulnerabilities spanning authenticated command injection and web-interface flaws. The highest-impact item highlighted is **CVE-2025-37168** (CVSS 8.2), an **unauthenticated arbitrary file deletion** vulnerability in AOS-8 Mobility Conductors that can delete critical files and trigger a DoS condition; additional fixes include an authenticated web management interface stack overflow in AOS-10 (**CVE-2025-37169**) that can enable privileged code execution, plus multiple authenticated command injection and file upload/write issues across AOS-8/AOS-10.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for multiple vulnerabilities in **HPE Aruba Networking** access points running **Instant AOS-8** and **AOS-10**, including two critical flaws that can lead to remote code execution. The most severe issues, tracked as `CVE-2024-42509` and `CVE-2024-47460`, affect the CLI service and can be exploited by an unauthenticated attacker by sending specially crafted packets to **UDP port 8211**, where the **PAPI** management protocol listens, enabling command injection and code execution on vulnerable devices. HPE also addressed four additional high-severity vulnerabilities — `CVE-2024-47461`, `CVE-2024-47462`, `CVE-2024-47463`, and `CVE-2024-47464` — that could allow a remote authenticated attacker to execute code or access sensitive information. HPE advised organizations to upgrade to fixed **AOS-10** and **Instant AOS-8** releases immediately, restrict exposure of management interfaces if patching cannot be completed at once, and replace Aruba products that have reached end of support.
Jul 24, 2026