CVE-2026-73749 is a critical (CVSS 9.8) set of flaws in a daemon of AOS-CX, the operating system of HPE Aruba CX switches. An unauthenticated attacker could send malformed packets and gain remote code execution with elevated privileges. Follow HPE bulletin hpesbnw05134en_us for fixed software.
What's affected
The record lists HPE Aruba CX switch models, including the CX 10000 and CX 10040 families and the CX 4100i. It describes multiple vulnerabilities in one daemon that mishandle malformed input. It does not name the daemon or give version numbers.
HPE's bulletin, hpesbnw05134en_us, is the source for affected and fixed AOS-CX releases. The HPE support page did not load as text for me, so open it in a browser. The same bulletin covers CVE-2026-73778.
How to check if you're exposed
On the switch, read the software version.
show version
Compare it with the fixed releases in the bulletin for your model. Also review which interfaces and networks can reach the switch's management and service ports.
What to do now
- List your Aruba CX switches and their AOS-CX versions.
- Read HPE bulletin hpesbnw05134en_us and identify the fixed release for each model.
- Schedule the upgrade, starting with switches that face less trusted networks.
- Restrict management plane access to a dedicated management network.
- Review switch configuration and logs for unexpected changes.
Why it matters
The record maps this to CWE-284, improper access control. That is a broad label, and the description adds the practical detail: malformed input to a network daemon, with no login needed, leading to code execution at a high privilege level.
Network switches are trusted infrastructure that sees a lot of traffic and often has long upgrade cycles. A flaw reachable without login on a core device deserves a quick look, even when the bulletin gives few specifics, as here. The KEV flag is false.
Quick check
Where do I find the fixed AOS-CX versions?
In HPE bulletin hpesbnw05134en_us. The record does not list them.
Sources
Last reviewed: 19 October 2026.
