External risk intelligence

AOS-CX Daemon Improper Input Processing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73749

AOS-CX is a network operating system used in enterprise switches. While primarily internal infrastructure, these devices frequently manage or sit at the edge of network segments and expose management services or daemons that are reachable over the network, making remote, unauthenticated access a common deployment consideration for network infrastructure components.

Remote Code Execution

Hpe Arubaos Cx

10.10.1180 and earlier10.13.0000 to 10.13.118010.16.0000 to 10.16.105110.17.0000 to 10.17.102110.18.0001

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Multiple vulnerabilities have been identified in a critical network operating system component that could allow an attacker to execute malicious code remotely with elevated privileges. This issue arises from improper handling of specially crafted network packets. The main concern is confirming if your environment utilizes this specific network operating system technology and assessing potential exposure.

Network system flaws enable remote code execution.
Affects network infrastructure, a critical business asset.
Confirm relevance and assess exposure in your environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could send specially crafted network packets to a vulnerable daemon within AOS-CX. This interaction targets how the system handles malformed input, potentially allowing the attacker to execute arbitrary code with elevated permissions on the device.

Entry condition: Attacker needs network access.
Trigger point: Sending malformed packets to a daemon.
Resulting risk: Remote code execution with elevated privileges.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in an AOS-CX daemon could allow an unauthenticated remote attacker to execute code with elevated privileges. This could happen when the daemon improperly processes specially crafted packets sent over the network.

Remote code execution with elevated privileges.
Sending specially crafted packets to the service.
Compromise of the affected network device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerabilities in the AOS-CX daemon require immediate attention from teams managing network infrastructure. The first step is to identify all instances of the affected technology, confirm their network exposure and business criticality, and then locate the accountable owners for each system. This will enable a risk-based remediation plan, coordinating efforts between network operations, security, and potentially vendor management if external assistance is needed.

Network and Security teams own this.
Verify network exposure and asset criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AOS-CX?

AOS-CX is a network operating system used to power enterprise-grade switches. It manages data traffic and network infrastructure, serving as the core software that allows switches to route information across corporate networks. Because it runs on critical networking hardware, it is fundamental to how data moves within an organization.

What does CVE-2026-73749 mean for AOS-CX?

This vulnerability involves an improper input validation weakness within a daemon, which is a background service in the operating system. Essentially, the software fails to properly check the data it receives. An attacker can take advantage of this flaw to force the system to execute unauthorized commands with the highest level of system privileges.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted, malformed data packets to the vulnerable daemon over the network. It is important to note that standard, legitimate network traffic does not trigger this issue. The flaw specifically requires the malicious, malformed input designed to exploit the service's improper processing logic.

Is my network device at risk?

Halo Surface Signal indicates that while AOS-CX is often internal infrastructure, these devices frequently manage network edges, making their services reachable over the network. If your switches are configured to allow remote access to management services or daemons, they may be reachable by an unauthenticated attacker, increasing the likelihood of risk.

What should I do first if I use AOS-CX?

Begin by creating a comprehensive inventory of all devices running AOS-CX in your environment. Once identified, work with your network and security teams to determine which devices are reachable over the network and assess their business criticality. Use this information to coordinate with your vendor for guidance and prepare a remediation plan.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.