CVE-2026-73749: Hpe Arubaos-Cx

What is CVE-2026-73749?

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS1% · P56

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-284

NVD published2026-09-01

NVD last modified2026-09-22

Timeline

2026-09-01Published to the U.S. National Vulnerability Database (NVD)
2026-09-04First covered in a defend.network daily briefing
2026-09-22NVD record last updated

Affected product

Hpe Arubaos-Cx

NVD also lists CPE entries for: Hpe Arubaos-Cx, Hpe Aruba Cx 10000-48y6c \(R8p13a\), Hpe Aruba Cx 10000-48y6c \(R8p14a\), Hpe Aruba Cx 10000-48y6c \(S0f98a\), Hpe Aruba Cx 10040 \(S4r58a\)

References

Referenced in our briefings & reports

Critical RCEs in Cisco Nexus, HPE ArubaOS; infrastructure compromises escalate (2026-09-04)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.

What is CVE-2026-73749?

Timeline

Affected product

References

Referenced in our briefings & reports

Get Critical CVE Alerts