# Your Core Network Just Became the Attack Surface: HPE's ArubaOS-CX RCE Flaw
Network switches don't make headlines the way endpoints do. That's precisely why attackers love them.
HPE has patched a critical remote code execution vulnerability in ArubaOS-CX, the operating system powering Aruba's CX-series campus and data center switches. The flaw allows an unauthenticated attacker to execute arbitrary code on the affected device — meaning if your switches run ArubaOS-CX and they're reachable, someone else might be running them too.
## What's Actually at Stake When a Switch Gets Owned
This deserves more explanation than most coverage gives it, because "RCE on a switch" doesn't land the same way as "RCE on a server" — and it should land harder.
When an attacker executes code on a network switch, they don't just own a box. They own the data plane. Every packet transiting that device is visible to them. They can clone traffic, intercept credentials in plaintext, poison ARP tables, manipulate routing, and create persistent footholds that survive reboots because switch firmware is rarely inspected the way server logs are. Detection is sparse. Forensic tooling is nearly nonexistent compared to endpoint telemetry. Most organizations have no EDR equivalent watching their Aruba CX switches.
The Aruba CX line sits in a lot of interesting places. HPE has pushed it hard into enterprise campus deployments, healthcare networks, financial services data centers, and university infrastructure. These are environments with high-value internal traffic, often with implicit trust between devices on the same segment. An attacker with code execution on a distribution-layer switch isn't trying to break in — they're already inside, watching everything flow past.
## The Pattern HPE Hasn't Shaken
This isn't the first time Aruba's networking OS has drawn this kind of attention.
In 2023, HPE patched multiple critical RCE vulnerabilities in ArubaOS — including CVEs affecting the PAPI protocol that scored 9.8 on CVSS. Those flaws affected ArubaOS-based wireless controllers and gateways. Proof-of-concept code went public within weeks of disclosure. In 2024, a separate cluster of Aruba vulnerabilities again hit the 9.x range, again involving unauthenticated paths to code execution. The pattern is a vendor with a broad, installed base of legacy and current devices, shipping patches that many customers apply slowly — or not at all.
ArubaOS-CX is HPE's "modern" OS, meant to replace older Aruba operating systems. But modern doesn't mean immune. And the upgrade cycle for network infrastructure is notoriously slow. Enterprises that refreshed their access layer three years ago and put in Aruba CX switches may still be running whatever firmware shipped from the factory.
## Why This One Gets Patched Last
There's a well-documented phenomenon in enterprise security: patch prioritization strongly favors endpoints and internet-facing servers. Network infrastructure sits in a different bucket — managed by a different team (often NetOps, not SecOps), on different maintenance windows, and with a much stronger cultural resistance to rolling updates on devices that "are working fine."
Aruba CX switches support hitless software upgrades on some stacked configurations, which removes one of the common excuses. But even with that capability, the reality is that most organizations patch their Windows servers within days of a critical Microsoft bulletin, and patch their core switches within months — if the vulnerability is severe enough to force it.
For an attacker, that gap is the whole game.
## What to Do Right Now
If you're running ArubaOS-CX anywhere in your environment, the immediate checklist is short:
## HackWire Analysis
The deeper story here isn't the vulnerability itself — it's the structural problem of network infrastructure as a security blind spot.
The security industry has spent the last decade building extraordinary endpoint visibility. EDR platforms can reconstruct an attack chain minute by minute from a compromised laptop. Meanwhile, the network switch that laptop is plugged into might be running firmware from 2021 with no integrity verification, no behavioral monitoring, and no incident response playbook for "what do we do if our access layer is compromised."
This isn't a vendor-specific critique. Cisco, Juniper, Palo Alto, and every other major networking vendor has issued critical RCE patches in the last two years. What's consistent across all of them is the asymmetry: the sophistication of enterprise endpoint security versus the primitiveness of network device security programs.
HPE Aruba's recurrence here is worth naming specifically. Three consecutive years of critical RCE disclosures across different ArubaOS product lines suggests the vulnerability research community is finding these fast, which means adversaries may be finding them too. The question for defenders isn't whether their Aruba gear has been targeted — it's whether they'd know if it had been. For most organizations, the honest answer is no.
The shift that needs to happen: network devices need to be treated as endpoints. That means firmware patch SLAs that match server patch SLAs, management network segmentation as a baseline control, and some form of configuration integrity monitoring. Attackers figured out that the network layer is under-defended. Defenders need to catch up.
— HackWire Editorial
---
## Related Coverage