Hewlett Packard Enterprise (HPE) has rolled out crucial updates for its ArubaOS-CX platform to address significant security vulnerabilities. These updates tackle 34 CVEs, including critical remote code execution (RCE) vulnerabilities, enhancing the platform’s security.
Details of the Security Patches
According to HPE’s advisory, the latest patches resolve over 150 flaws in various AOS-CX versions, such as 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181. Several of these vulnerabilities are grouped under specific CVEs for streamlined tracking.
One of the most severe issues, identified as CVE-2026-73749 with a CVSS score of 9.8, comprised nearly two dozen vulnerabilities. These were addressed in the recent updates, significantly bolstering the platform’s defense mechanisms.
Understanding the Critical Vulnerabilities
The critical flaws stem from improper handling of malformed inputs sent to an unnamed service within HPE’s enterprise switch operating system. This vulnerability could allow an unauthenticated attacker to execute remote code with elevated permissions by dispatching crafted packets to the susceptible service.
In addition to the critical RCE vulnerabilities, the update also fixes 22 high-severity CVEs. These CVEs could potentially enable denial-of-service attacks, arbitrary command execution, script code execution in browsers, authentication bypass, privilege escalation, and information leakage.
Recommendations and Future Outlook
The remaining 11 CVEs are classified as medium-severity and involve issues like access control bypass, information leakage, arbitrary file reads, denial-of-service, and privilege escalation.
HPE states that most of these vulnerabilities were identified internally by its security team and there are no known instances of these being exploited in real-world scenarios. To mitigate potential risks, HPE advises restricting management interfaces to a dedicated layer 2 segment or VLAN, and implementing firewall policies at layer 3 or higher, alongside robust accounting controls.
As cybersecurity threats evolve, it is essential for enterprises to stay vigilant and regularly update their systems to protect against potential exploits. HPE’s proactive approach in addressing these vulnerabilities is a crucial step in maintaining network security.
