ArubaOS-CX Buffer Overflow RCE (CVE-2026-73749): Affected Releases and Mitigation

Vulnerability boundary

CVE-2026-73749 is a CVSS 9.8 buffer-overflow vulnerability in an AOS-CX daemon. An unauthenticated remote attacker can send crafted packets to the affected service and potentially execute code with elevated privileges. Because the target is a network operating system service, the response must cover the actual packet path, switch software branch, management segmentation, configuration evidence, and post-upgrade behavior.

The upstream selection identifies this critical issue for standalone treatment from the larger HPE bulletin. Account credentials and user interaction are not required. A switch that is not directly exposed to the internet may still be reachable from a jump host, monitoring platform, automation server, wireless management network, or connected operational segment.

Affected and fixed releases

HPE lists AOS-CX 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, and the end-of-maintenance 10.10.1180 branch and earlier. Fixed builds are 10.18.1002+, 10.17.1030+, 10.16.1060+, 10.13.1190+, and 10.10.1181+. HPE notes that the old 10.10 branch only received fixes for internally identified critical issues, so a supported branch remains the durable target.

Record the exact build, model, management address, management VLAN, redundancy peer, and operating role for every asset. Version-family labels are not precise enough to select a fixed image or plan a safe change.

Network and change controls

HPE recommends restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN, enforcing Layer 3 or higher firewall policy, and keeping accounting records for administrative activity. Enumerate every source that can reach switch management addresses and remove broad paths that are not operationally required.

Before an upgrade, preserve the running image, boot variables, configuration backup, route-neighbor state, VSX or stacking state, CPU and memory baselines, interface errors, and central logs. Upgrade one failure domain at a time. Validate control-plane convergence, forwarding, management access, logging, and automation before moving to the next peer.

Response sequence

1. Inventory model, exact AOS-CX build, management address, and VLAN.
2. Match each device to HPE's affected and fixed release table.
3. Map every jump host, tool, and network path that can reach management services.
4. Restrict access with dedicated segmentation and minimum-necessary policy.
5. Upgrade by redundancy domain to the fixed build for the active branch.
6. Compare routing, forwarding, VSX, management, and logs with the baseline.

Keep the installed build, change time, access policy, baseline comparison, and reviewer sign-off in one remediation record. If a new build causes an operational issue, use the rollback procedure only to restore service, keep the management-path restriction in place, and schedule a supported fixed build rather than leaving the vulnerable image as the steady state.