CVE-2026-73749

Analyzed Analyzed - Analysis Complete

Remote Code Execution in HPE ArubaOS-CX Daemon

Publication date: 2026-09-01

Last updated on: 2026-09-04

Assigner: Hewlett Packard Enterprise (HPE)

Description

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-04

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73749

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves multiple flaws in a daemon of AOS-CX that improperly processes malformed input. An unauthenticated remote attacker can exploit these flaws by sending specially crafted packets to the affected service. Successful exploitation may lead to remote code execution with elevated privileges.

Detection Guidance

To detect this vulnerability, monitor network traffic for malformed packets sent to the AOS-CX daemon. Check for unusual service behavior or crashes on affected systems. Use packet inspection tools like tcpdump or Wireshark to capture and analyze traffic to the daemon's port. Ensure your intrusion detection systems (IDS) are updated with signatures for this CVE.

Impact Analysis

An attacker could gain control of the affected system remotely without authentication, potentially leading to unauthorized access, data breaches, or system compromise. This could disrupt services or allow further attacks within the network.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, or loss of certification if exploited.

Mitigation Strategies

Apply patches or updates provided by HPE for AOS-CX to address the improper input processing vulnerabilities. Isolate or restrict network access to the affected service until patched. Monitor network traffic for unusual activity targeting the daemon.

Hi! I’m here to help you understand CVE-2026-73749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70