HPE Patches Critical RCE Vulnerabilities in AOS-CX

What happened

The template says security posts use the same chrome and section titles from post_format.SECTION_PLANS. The user has explicitly specified the five section headings to use, so I'll follow those. The user's instructions are the authoritative spec here.

Hewlett Packard Enterprise has released security updates to fix a collection of vulnerabilities in AOS-CX, the operating system that runs its campus and data-center switching portfolio. The vulnerabilities, tracked collectively under CVE-2026-73749, carry a CVSS score of 9.8 out of 10 and allow remote code execution, placing them in the most critical tier of severity. Nearly two dozen individual issues were addressed in the update package.

This article breaks down what the patches cover, which organizations face the greatest exposure, the steps network teams should take immediately, how remote code execution flaws of this class typically function, and what the public disclosure has not yet clarified. It is aimed at network engineers, security architects, and infrastructure teams that operate HPE switching hardware.

How it works

HPE published a security advisory disclosing that AOS-CX, the operating system used across its line of managed switches, contained nearly two dozen vulnerabilities. The issues were assigned the collective identifier CVE-2026-73749 and received a CVSS base score of 9.8, the highest band short of a perfect 10. That score reflects network exploitability without requiring authentication or user interaction, the three factors that push a vulnerability to the top of triage queues. HPE addressed all of the reported issues through a coordinated update release, meaning patched software is now available to customers.

The collective CVE identifier suggests that security researchers or HPE's internal team discovered a cluster of related flaws, likely sharing a common code path or protocol handler rather than being entirely independent bugs. When a vendor groups nearly two dozen issues under one tracking number, it usually indicates a systematic audit that uncovered multiple instances of the same root weakness across different features or modules. The practical implication is that the attack surface was wider than a single isolated bug would suggest.

Any organization running HPE AOS-CX switches in a configuration that exposes management interfaces to untrusted network segments is at elevated risk. Campus networks, enterprise data centers, and managed service providers that use HPE switching hardware as their core or distribution layer are the primary audience for this advisory. The CVSS score of 9.8 assumes network-level access rather than local access, meaning an attacker does not need to be physically present or already authenticated to attempt exploitation.

Why it matters

Environments where switch management planes are reachable from guest networks, shared cloud-connected segments, or inadequately segmented zones face the highest immediate exposure. Out-of-band management networks that are truly isolated represent a meaningful compensating control, but any site that has not verified that isolation is effectively in the same exposure tier as a fully internet-facing device. Organizations in critical infrastructure sectors that deploy HPE switching in operational technology-adjacent environments should treat this advisory with the same urgency applied to enterprise IT.

The first action is to verify which AOS-CX versions are running across your switching estate and cross-reference those against HPE's advisory to confirm whether each device is on a vulnerable build. HPE has released updated software to address CVE-2026-73749, so the primary remediation path is applying those updates. Because nearly two dozen issues were addressed together, partial patching is not a viable middle ground; the full update is the only way to close the entire set of reported vulnerabilities.

Who is affected

While patching is underway, network teams should review access control lists and firewall rules governing reach to switch management interfaces, including SSH, the web management console, and any REST API endpoints exposed by AOS-CX. Restricting access to trusted management hosts or a dedicated out-of-band network reduces the window of exposure during staged rollouts. Once patches are applied, review device logs for anomalous management-plane activity that may indicate reconnaissance or exploitation attempts that occurred prior to remediation.

A CVSS score of 9.8 on a remote code execution vulnerability indicates that the flaw is exploitable over the network, requires no authentication, and demands no interaction from a legitimate user on the target device. In practical terms, an attacker who can reach the vulnerable service sends crafted input that causes the switch operating system to execute arbitrary code under whatever privilege level the affected process runs. On network operating systems, management-plane processes frequently run with elevated privileges, meaning successful exploitation can yield full administrative control of the device.

The collective nature of CVE-2026-73749 across nearly two dozen issues points to a class of vulnerability — such as memory corruption, improper input validation, or a parser flaw — that appeared in multiple places within the AOS-CX codebase rather than a single defective function. When the same weakness pattern recurs across a network OS, the implications extend beyond patching one service: the broader code quality in that area warrants scrutiny, and defenders should anticipate that additional related issues could surface in future research by parties who now know where to look.

What to watch next

The public disclosure has not specified which individual services or protocol handlers within AOS-CX are affected by the nearly two dozen vulnerabilities grouped under CVE-2026-73749. Without that detail, network teams cannot make targeted decisions about disabling specific features as a short-term compensating control and must instead treat the entire management plane as suspect until patches are applied. HPE has not publicly released proof-of-concept code or a technical write-up explaining the root cause, which is standard practice during a coordinated disclosure period.

It is also not yet clear whether any of the vulnerabilities were exploited in the wild before HPE released the advisory, or whether the discovery originated from internal HPE research, an external bug bounty submission, or a coordinated report from a third-party security firm. That provenance matters because it shapes the probability that a working exploit already exists outside controlled channels. Organizations with extended patch windows should monitor threat intelligence feeds for any indication that CVE-2026-73749 has moved from theoretical to active exploitation.