Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.

A pre-authentication XXE injection on ArubaOS 8.13.2.0 port 32000 enables OOB SSRF. Confirmed via wire-level pcap and the controller's own sshd logs. Submitted to HPE Bugcrowd — closed as theoretical despite four evidence items.

Aufgrund von mehreren Sicherheitslücken in ArubaOS und InstantOS sind Schadcode-Attacken auf Aruba-Geräte möglich.

HPE Aruba hat eine Sicherheitsmitteilung zu mehreren Lücken herausgegeben. Angreifer können Befehle einschleusen oder einen DoS auslösen.

Noch ein kurzer Nachtrag von dieser Woche. In den Cisco Nexus 9000-Switches gibt es einen kritische Schwachstelle, die eine Übernahme ermöglicht. Im HPE ArubaOS-CX gibt es kritische Schwachstellen…

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.

 Hewlett Packard Enterprise has released a security advisory for Aruba Networking ArubaOS-CX, warning customers about multiple vulnerabilities affecting the switch operating system. The advisory, published on September 1, 2026, says HPE has issued updates to address the issues and urges administrators to review their deployments promptly.  According to the advisory and related vulnerability listings, the flaws span several categories. Some issues can expose sensitive information through API endpoints, while others may allow denial of service, stored cross-site scripting, arbitrary file write behavior, or path traversal under certain conditions. The breadth of the report suggests that both the management interface and backend API paths were part of the security review.  The most serious concerns are likely to be those that could let an authenticated attacker influence device behavior or reach deeper system components. One vulnerability involves an API endpoint that could allow a low-privilege authenticated operator to change certain settings, while another points to stored XSS in the web-based management interface. Other disclosures describe file-writing and traversal weaknesses that may, in some cases, lead to remote code execution or broader system compromise.  For enterprise users, the practical takeaway is simple: check which ArubaOS-CX version is deployed and compare it with the affected branches listed in public vulnerability records. Network administrators should prioritize patching, especially on systems used for core switching, segmentation, and centralized management. HPE’s release indicates that updates are available, making this a straightforward remediation case rather than a purely advisory-only notice.  Organizations using ArubaOS-CX should treat the bulletin as a reminder to keep network infrastructure current. Security gaps in switching platforms can have wider consequences than a single device issue, especially when they involve administrative interfaces and API access. Applying the vendor update and validating exposure across affected versions are the most important next steps.

Hewlett Packard Enterprise (HPE)がArubaOS-CXネットワークOSの重大な脆弱性をパッチリリース。この脆弱性はリモートコード実行(RCE)を引き起こす可能性がある。ネットワークスイッチやルータの管理者は緊急のアップデート適用が推奨される。

HPE released patches for 34 CVEs in ArubaOS-CX. Two independent unauthenticated RCE vulnerabilities in the same bulletin point to a systemic secure-development issue in the network OS.

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution.

Curate Feeds | Make Collections | Customize Email Briefs

HPE patched 35 ArubaOS-CX flaws, including a critical bug that could enable remote code execution.

Groups Conversations All groups and messages Sign in     HPESBNW05134 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ArubaOS-CX (AOS-CX) 0 views Eyal Estrin unread, 1:11 AM (19 minutes ago)    to https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. [...]

according to HPE, and only solutions for internally found read more about HPE patches critical ArubaOS-CX remote code execution flaw

HPE released patches on September 1, 2026 for 34 vulnerabilities in the ArubaOS-CX (AOS-CX) platform, the operating system powering enterprise, data center, and campus switches. Two of these flaws allow unauthenticated remote code execution with maximum impact on network traffic compromise risk. The

Die Entwickler von HPE Aruba Networking haben 34 Sicherheitslücken in ArubaOS-CX geschlossen.

Hewlett Packard Enterprise (HPE) has released patches for 34 CVEs in Aruba Networking ArubaOS-CX, including critical remote code execution flaws that could let an unauthenticated attacker compromise enterprise switches. The update fixes more than 150 issues across multiple versions, and HPE says it is not aware of any of the vulnerabilities...

NCSC-NL meldet mehrere Schwachstellen in Aruba Networks ArubaOS-CX mit dem Schweregrad hoch. Die vollständige Beschreibung mit betroffenen Versionen und empfohlenen Maßnahmen steht beim NCSC-NL.