HPE ArubaOS-CX: 25 Vulnerabilities Disclosed, Highlighting Auth Bypass and Command Injection Risks
Key findings • HPE disclosed 25 vulnerabilities in ArubaOS-CX on September 1, 2026. • Flaws include authentication bypass, command injection, XSS, and DoS. • Multiple high-severity vulner…
Key findings
- HPE disclosed 25 vulnerabilities in ArubaOS-CX on September 1, 2026.
- Flaws include authentication bypass, command injection, XSS, and DoS.
- Multiple high-severity vulnerabilities allow unauthenticated access and command execution.
- Web interface flaws include XSS and CSRF, enabling targeted attacks.
- Patching is critical to mitigate risks from this extensive disclosure.
On September 1, 2026, Hewlett Packard Enterprise (HPE) disclosed a significant batch of 25 vulnerabilities affecting its ArubaOS-CX operating system. These vulnerabilities, all disclosed on the same day, span a range of severity levels, with a notable concentration of high-severity flaws. The disclosures highlight potential risks including authentication bypass, command injection, cross-site scripting, and denial-of-service conditions, underscoring the need for prompt attention from administrators managing HPE network infrastructure.
Several high-severity vulnerabilities focus on authentication bypass and privilege escalation. CVE-2026-73779 and CVE-2026-73764, for instance, could allow unauthenticated remote actors to circumvent existing authentication controls, potentially compromising system integrity and exposing sensitive information. Similarly, CVE-2026-73778 presents a risk of unauthorized administrative access, particularly on devices in their factory-default state. Other vulnerabilities, such as CVE-2026-73777 and CVE-2026-73766, allow authenticated attackers to circumvent authentication controls or inject arbitrary commands via API endpoints.
Command injection and arbitrary file write capabilities are also prominent themes within this batch. CVE-2026-73768 and CVE-2026-73767, affecting the command-line interface and API endpoints respectively, could allow authenticated attackers to execute arbitrary commands with root privileges or write arbitrary files, potentially leading to remote code execution. CVE-2026-73770 details an authenticated arbitrary file write vulnerability that, under specific conditions, could allow for command execution as a privileged user.
Web interface vulnerabilities include stored cross-site scripting (XSS) and Cross-Site Request Forgery (CSRF) flaws. CVE-2026-73781 describes a stored XSS vulnerability in the web-based management interface, allowing attackers to execute script code in a victim's browser. CVE-2026-73780 highlights a lack of CSRF protection, enabling unauthenticated attackers to execute arbitrary input if they can trick an authenticated user. Additionally, CVE-2026-73757 points to a Server-Side Request Forgery (SSRF) vulnerability in the management interface, which could be used for internal network reconnaissance.
Denial-of-service (DoS) vulnerabilities are also present, with several CVEs detailing how unauthenticated or authenticated actors could disrupt system operations. CVE-2026-73783 describes stack overflow vulnerabilities in an API endpoint leading to DoS. CVE-2026-73773 details an unauthenticated DoS vulnerability in an API endpoint, and CVE-2026-73759 outlines similar DoS risks from crafted packets. CVE-2026-73771 and CVE-2026-73772 also contribute to the DoS risk landscape through authentication bypass and buffer overflow issues, respectively.
The batch also includes vulnerabilities related to information disclosure. CVE-2026-73775 allows low-privilege authenticated attackers to access sensitive information via API endpoints, potentially aiding further network access. CVE-2026-73774 and CVE-2026-73761 describe buffer overflow vulnerabilities in the operating system that could lead to unauthenticated disclosure of sensitive information through specially crafted packets. CVE-2026-73760 is an out-of-bounds read vulnerability leading to information disclosure.
HPE has provided security advisories detailing the affected versions and the patches released to address these vulnerabilities. Users of HPE ArubaOS-CX are strongly advised to consult the official advisories and apply the necessary updates to mitigate the risks associated with this extensive set of disclosures. Prompt patching is crucial to prevent potential exploitation of these diverse security weaknesses.
This coordinated disclosure event underscores the importance of continuous security vigilance for network infrastructure. The breadth of vulnerabilities, from authentication bypass to command injection and DoS, necessitates a thorough review of security postures and the timely application of patches by organizations relying on HPE ArubaOS-CX. Staying informed about vendor security bulletins and prioritizing updates remains a critical defense strategy.