HPE Ships AOS-CX Fixes for Clustered RCE at CVSS 9.8 Across Five Branches

HPE’s advisory lists more than 150 total defects fixed, with nearly two dozen issues bundled under CVE-2026-73749 (CVSS 9.8). The root cause is improper handling of malformed input to an internal service; unauthenticated attackers can send crafted packets and obtain elevated remote code execution. Twenty-two additional high-severity CVEs cover DoS, command injection, authentication bypass and privilege escalation. Eleven medium issues add file disclosure and access-control bypass.

Procurement records and prior Aruba advisories show repeated emphasis on management-plane hardening, yet the same exposure vectors recur. HPE states all flaws were found internally and none are exploited in the wild. Independent telemetry from Shodan and Censys indicates thousands of AOS-CX instances still expose web and SSH interfaces to the public internet, contradicting the “restrict to dedicated VLAN” guidance in practice.

The pattern matches earlier switch OS clusters where internal discovery claims preceded public PoCs within weeks once patches were available. No independent technical attribution of prior exploitation exists, yet the concentration of unauthenticated RCE in a single service raises the probability of rapid weaponization.

Operators should inventory exposed management planes, apply the listed releases immediately, and enforce layer-3 ACLs plus logging before the next disclosure cycle.