HPE Aruba AOS-CX Patches Dozens of Flaws
HPE Aruba Networking issued patches for numerous vulnerabilities in AOS-CX and Fabric Composer, including remote code execution, privilege escalation and denial-of-service bugs.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has relayed two HPE Aruba Networking security bulletins (HPESBNW05133 and HPESBNW05134) addressing a large batch of vulnerabilities affecting AOS-CX network operating system across multiple release branches (10.10.x, 10.13.x, 10.16.x, 10.17.x, 10.18.x) as well as Fabric Composer prior to version 7.3.4. The flaws span a wide range of vulnerability classes including remote code execution, privilege escalation, remote denial of service, SQL injection, cross-site scripting, cross-site request forgery, server-side request forgery, and security policy bypass, along with impacts to data confidentiality and integrity.
No evidence of active exploitation is mentioned in the advisory. HPE Aruba has published fixed versions for all supported branches; the 10.10.x branch is end-of-life and has only received fixes for the most critical issues, so CERT-FR recommends migrating to a maintained release. Given the breadth of affected components (core switching/network fabric management software) and the range of impacts up to remote code execution and privilege escalation, organizations running AOS-CX or Fabric Composer should prioritize patching per the vendor's guidance, particularly on internet- or management-network-exposed devices.
This is a vendor patch advisory rather than an incident report; defenders should inventory affected AOS-CX and Fabric Composer deployments, apply the referenced fixed builds, and monitor vendor bulletins for any subsequent in-the-wild exploitation updates.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1104
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs