HPE Issues Critical Patches for ArubaOS-CX Remote Code Execution Flaw

SAN FRANCISCO — Hewlett Packard Enterprise (HPE) released emergency security patches on Wednesday to address critical vulnerabilities in its ArubaOS-CX network operating system, including a flaw that allows attackers to execute code remotely without authentication.

The update, issued globally at 18:34 GMT on September 3, 2026, targets the ArubaOS-CX software used to manage enterprise networking infrastructure. The most severe vulnerability identified in the release is tracked as CVE-2026-73749. Security researchers and HPE engineers warn that this flaw could enable an unauthenticated remote attacker to gain full control over affected network switches, potentially leading to data theft, network disruption, or the deployment of malicious payloads across connected systems.

HPE stated in a security advisory that the vulnerabilities exist within the core operating system logic of ArubaOS-CX versions deployed on its CX series switches. The company urged all customers running vulnerable software to apply the patches immediately. The advisory highlighted that successful exploitation of CVE-2026-73749 does not require user interaction, making it a high-priority threat for network administrators worldwide.

The patches address a cluster of related security issues beyond the primary remote code execution flaw. While HPE has not disclosed specific details regarding other potential attack vectors in the public advisory, the company emphasized that the cumulative risk to networks running unpatched versions is significant. The update applies to a wide range of Aruba CX switch models currently in operation across financial institutions, healthcare providers, and large corporate campuses globally.

Network security experts note that remote code execution vulnerabilities in network operating systems are among the most dangerous classes of flaws because they can compromise the underlying infrastructure of an organization's digital operations. Once inside a network device, attackers can pivot to other systems, intercept sensitive traffic, or manipulate network configurations to facilitate further intrusions.

HPE has directed customers to its support portal to download the necessary firmware updates and configuration files required to remediate the issues. The company advised administrators to schedule maintenance windows where possible to avoid service interruptions during the patching process, though it stressed that the urgency of the threat may necessitate immediate action in high-risk environments.

As organizations begin deploying the fixes, questions remain regarding the extent of any potential exploitation prior to the public disclosure of the flaw. HPE has not confirmed whether there is evidence of active attacks targeting CVE-2026-73749 in the wild, nor has it specified if any known threat actors have weaponized the vulnerability. Security teams are advised to monitor their network logs for signs of unauthorized access or anomalous traffic patterns while ensuring all systems are updated to the latest secure versions.