HPE Aruba AOS-CX Patches Dozens of Flaws

HPE Aruba Networking issued patches for numerous vulnerabilities in AOS-CX and Fabric Composer, including remote code execution, privilege escalation and denial-of-service bugs.

CERT-FR has relayed two HPE Aruba Networking security bulletins (HPESBNW05133 and HPESBNW05134) addressing a large batch of vulnerabilities affecting AOS-CX network operating system across multiple release branches (10.10.x, 10.13.x, 10.16.x, 10.17.x, 10.18.x) as well as Fabric Composer prior to version 7.3.4. The flaws span a wide range of vulnerability classes including remote code execution, privilege escalation, remote denial of service, SQL injection, cross-site scripting, cross-site request forgery, server-side request forgery, and security policy bypass, along with impacts to data confidentiality and integrity.

No evidence of active exploitation is mentioned in the advisory. HPE Aruba has published fixed versions for all supported branches; the 10.10.x branch is end-of-life and has only received fixes for the most critical issues, so CERT-FR recommends migrating to a maintained release. Given the breadth of affected components (core switching/network fabric management software) and the range of impacts up to remote code execution and privilege escalation, organizations running AOS-CX or Fabric Composer should prioritize patching per the vendor's guidance, particularly on internet- or management-network-exposed devices.

This is a vendor patch advisory rather than an incident report; defenders should inventory affected AOS-CX and Fabric Composer deployments, apply the referenced fixed builds, and monitor vendor bulletins for any subsequent in-the-wild exploitation updates.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1104