# HPE Issues Urgent Security Updates for Critical Flaws in ArubaOS-CX and ClearPass

> Hewlett Packard Enterprise has released urgent security updates for its ArubaOS-CX switches and ClearPass Policy Manager to address multiple critical vulnerabilities, some with a maximum CVSS score of 9.8, that could allow unauthenticated remote attackers to gain administrative control or execute malicious code.

By PrimaryBrief newsroom · Published 2026-10-23T12:55:41.287184Z
Canonical: https://primarybrief.com/article/hpe-issues-urgent-security-updates-for-critical-flaws-in-arubaos-cx-and-clearpass-08ba98fd

Hewlett Packard Enterprise (HPE) has released urgent security updates for its ArubaOS-CX switches and ClearPass Policy Manager, addressing multiple critical vulnerabilities, some with a maximum CVSS score of 9.8, that could allow unauthenticated remote attackers to gain administrative control or execute malicious code [2][3][6]. These flaws affect widely deployed enterprise network equipment, leaving organizations vulnerable to potential data breaches, system compromise, and significant network disruption if not patched immediately [3][16].

## What the records show
The security advisories from HPE describe several critical flaws affecting ArubaOS-CX switches and ClearPass Policy Manager [2][3][6]. One significant vulnerability, CVE-2026-73749, is a buffer overflow in ArubaOS-CX switches that could enable remote code execution with elevated privileges [3][9][12]. Another, CVE-2026-23813, is an authentication bypass in the web management interface of ArubaOS-CX switches, allowing an unauthenticated remote actor to reset administrator passwords [2][4][17]. For ClearPass Policy Manager, CVE-2026-76752 is a critical authentication bypass in its web-based management and API interfaces, which could grant unauthenticated remote attackers administrative access [6][10][11]. All three of these critical vulnerabilities received a CVSS v3.1 base score of 9.8, indicating their severity [3][6][15]. Other high-severity issues addressed include command injection and information disclosure [3].

## The timeline
HPE announced patches for the critical authentication bypass CVE-2026-23813 in ArubaOS-CX switches around March 14, 2026 [2]. In September 2026, specifically by September 1, HPE released patches for 35 flaws in ArubaOS-CX, including the critical remote code execution vulnerability CVE-2026-73749 [3][9]. Most recently, on October 6, 2026, HPE disclosed CVE-2026-76752, the critical authentication bypass affecting ClearPass Policy Manager, releasing updates for it [6][10].

## What changed and for whom
Network administrators managing ArubaOS-CX switches and ClearPass Policy Manager now have essential security updates to apply [3][6]. Successful exploitation of these vulnerabilities could grant attackers full administrative control over affected devices, allowing them to intercept traffic, modify access policies, and move laterally across network segments [3][14]. Experts advise that administrators immediately apply patches, restrict access to management interfaces, and strengthen credential management practices [3][13]. Shane Barney, chief information security officer at Keeper Security, stated that admin access to AOS-CX switches provides "a direct path to control over the network" [3]. Ram Varadarajan, founder and CEO at Acalvio, noted that network administrators fear this type of bug the most, as an attacker might need no password or user interaction to take control [3].

## What the subject has said publicly
HPE Aruba Networking has stated that its internal security research teams generally discovered these vulnerabilities [13]. The company reported that it was not aware of any public discussion or active exploitation of these specific flaws at the time of their disclosure [13][16].

## What we could not confirm
Whether any of these vulnerabilities have been exploited in the wild since their disclosure remains unconfirmed.
Whether public proof-of-concept code has been released for these vulnerabilities is not confirmed.

## Evidence cited
1. HPE Aruba Networking Issues Urgent Security Advisory for Critical RCE Vulnerabilities in ArubaOS — https://presale1.com/
2. HPE Patches Critical Vulnerability in Aruba Networking AOS-CX (SecurityWeek) — https://securityweek.com/
3. HPE ArubaOS-CX patches include critical RCE with elevated privileges (SC World) — https://scworld.com/
4. HPE Aruba Networking Issues Urgent Patches for AOS-CX Vulnerabilities — https://securityonline.info/
5. Emergency Security Bulletin: Authentication Bypass in HPE Aruba Networking AOS-CX (CVE-2026-23813) (RedLegg) — https://redlegg.com/
6. CVE-2026-76752: Critical Authentication Bypass in HPE Networking ClearPass Policy Manager (IONIX) — https://ionix.io/
7. CVE-2026-23813: Critical Authentication Bypass in HPE AOS-CX Switches (SentinelOne) — https://sentinelone.com/
8. CVE-2026-23813 Detail (NIST) — https://nist.gov/
9. CVE-2026-73749 (CVE) — https://cve.org/
10. CVE-2026-76752 - HPE ClearPass Policy Manager Authentication Bypass — https://offseq.com/
11. HPE ClearPass - Ten Critical Flaws (Oct 2026) - Secure ISS — https://secure-iss.com/
12. HPE patches critical RCE flaw in ArubaOS-CX network OS, update now (BleepingComputer) — https://bleepingcomputer.com/
13. HPESBNW05134 rev. 1 - Multiple Vulnerabilities in HPE Aruba Networking ArubaOS-CX (AOS-CX) (HPE) — https://hpe.com/
14. HPE Aruba Networking AOS-CX Critical Vulnerabilities: CVE-2026-23813 & CVE-2026-23814 (Cycognito) — https://cycognito.com/
15. Multiple Security Vulnerabilities in HPE Aruba Networking AOS-CX (Cyber Security Agency of Singapore) — https://csa.gov.sg/
16. HPE ArubaOS-CX Critical Security Updates: CVE-2026-73749 RCE & More (Rescana) — https://rescanada.com/
17. Critical HPE Aruba flaw allows unauthenticated password reset of network switches (CSO Online) — https://csoonline.com/