CVE-2026-73774 Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX

What is CVE-2026-73774?

CVE-2026-73774 is a high-severity memory corruption vulnerability in Hpe Arubaos-Cx, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure or modification of information and disruption of the affected system.

Weakness: CWE-120

Which versions are affected by CVE-2026-73774?

It affects 1 product.

Products include Hpe Arubaos-Cx.

How do I fix CVE-2026-73774?

No fix has been published for CVE-2026-73774 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-73774 being exploited?

There is no known exploitation of CVE-2026-73774 in the wild and no public exploit code.

Other vulnerabilities in Hpe Arubaos-Cx

• CVE-2026-73749 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX Critical 9.8
• CVE-2026-23813 Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset Critical 9.8
• CVE-2026-73750 Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution High 8.8
• CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface High 8.8
• CVE-2026-73752 Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX High 8.8

All Hpe Arubaos-Cx vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v6f2-xccv-v7j7.