HPE Issues Urgent Security Updates for Critical Flaws in ArubaOS-CX and ClearPass
Hewlett Packard Enterprise has released urgent security updates for its ArubaOS-CX switches and ClearPass Policy Manager to address multiple critical vulnerabilities, some with a maximum CVSS score of 9.8, that could allow unauthenticated remote attackers to gain administrative control or execute malicious code.
Original PrimaryBrief article graphic. Not a photograph of the event.
THE PRIMARY BRIEF
01 · The primary finding
Hewlett Packard Enterprise (HPE) has released urgent security updates for multiple critical vulnerabilities in its ArubaOS-CX switches and ClearPass Policy Manager, including remote code execution and authentication bypass flaws with CVSS scores of 9.8.
02 · The primary evidence
HPE disclosed these vulnerabilities and released patches in March, September, and October 2026, noting that most were discovered internally and there was no awareness of public exploitation at the time of disclosure.
03 · Why it matters
These critical flaws affect widely deployed enterprise network infrastructure, potentially allowing unauthenticated remote attackers to gain full administrative control, reset passwords, or execute code, posing significant risks of data breaches and network compromise.
17 cited sources · 17 independent publishers
Hewlett Packard Enterprise (HPE) has released urgent security updates for its ArubaOS-CX switches and ClearPass Policy Manager, addressing multiple critical vulnerabilities, some with a maximum CVSS score of 9.8, that could allow unauthenticated remote attackers to gain administrative control or execute malicious code. These flaws affect widely deployed enterprise network equipment, leaving organizations vulnerable to potential data breaches, system compromise, and significant network disruption if not patched immediately.