# When Your Switches Can Be Hijacked: HPE's AOS-CX RCE Problem Is Bigger Than a Patch Tuesday
The devices running your network are supposed to be invisible infrastructure — background machinery you configure once and forget. That assumption is exactly why remote code execution vulnerabilities in network operating systems are so much worse than RCEs in, say, a web application. When an attacker owns your switches, they own the pipes everything else runs through.
HPE has issued patches for critical remote code execution vulnerabilities in AOS-CX, the network operating system powering its Aruba CX switching line. The affected hardware is not niche equipment. Aruba CX switches are data center and campus workhorses deployed across enterprise, healthcare, higher education, and government environments — organizations that chose them specifically because HPE marketed them as modern, API-driven, and built for zero-trust architectures. The irony of that last point deserves a moment.
## What AOS-CX Is and Why It's in So Many Places
AOS-CX is HPE/Aruba's current-generation switch OS, a full rewrite from the older ArubaOS that was meant to bring programmability and cloud management to campus and data center switching. The platform runs on the CX 6000, 6100, 6200, 6300, and 6400 series — and for organizations that have been through an HPE refresh cycle in the last four or five years, these are likely their primary switching layer.
The programmability angle matters here. AOS-CX ships with REST APIs, Python scripting support via NAE (Network Analytics Engine), and integrations with platforms like Aruba Central for cloud management. More attack surface, more vectors. A network OS that was deliberately designed to be programmable and API-accessible represents a meaningfully larger attack surface than a traditional switch that you configure via CLI and call it a day.
Critical RCE vulnerabilities in this context do not mean a bad actor crashes a web form. They mean the possibility of persistent code execution on devices sitting at the heart of layer 2 and layer 3 network segmentation — devices that can see, shape, and redirect virtually all traffic traversing them.
## The Access Question Nobody Is Asking Loudly Enough
Every advisory about network infrastructure vulnerabilities eventually says "ensure management interfaces are not exposed to the internet," and security teams have internalized this to the point where it's almost dismissed as obvious. But the threat model for AOS-CX RCE is not primarily an external attacker connecting to management port 443 from their kitchen table.
The real exposure is lateral movement. An attacker who has already established a foothold — through phishing, a compromised endpoint, a VPN credential — and who has network access to the management VLAN (or to AOS-CX's REST API endpoint, if it's accessible from production VLANs) now has a path to the switches themselves. At that point, they can manipulate ACLs, redirect traffic, intercept unencrypted east-west flows, and establish persistence that survives endpoint remediation. You can reimage every server in your environment and the attacker is still there, watching from inside the fabric.
This is not a hypothetical attack chain. It's what sophisticated actors do when they want durable access that survives incident response.
## A Pattern HPE Should Be Embarrassed About
Network infrastructure vendors have been slow to apply the security rigor that software companies — under pressure from CISA, from customers, and from public shaming — have been forced to adopt over the past five years. But "slow to apply security rigor" is a generous framing.
Cisco IOS XE suffered a catastrophic zero-day exploitation campaign in late 2023. Juniper patched a critical RCE chain in J-Web in 2023 that was almost immediately weaponized. Palo Alto's PAN-OS had multiple critical vulnerabilities exploited in the wild across 2024 and 2025. The pattern is consistent: network OS vendors discover critical vulnerabilities, patch them, and then watch as organizations that haven't patched get breached weeks or months later — because patching network infrastructure is genuinely operationally painful.
It requires maintenance windows. It may require console access if something goes wrong. It breaks things that weren't supposed to break. Network teams are often under-resourced, and patching a core switch in a production data center is a different proposition than pushing a security update to a workstation. Attackers understand this calculus better than most defenders do.
## What Defenders Should Do Today
The advisory exists. The patches exist. The question is execution.
Immediate priorities:
If your organization cannot patch critical infrastructure within 30 days of a critical advisory, that is a process problem that needs to be addressed at a program level — not just for this vulnerability, but as a systemic gap.
---
## HackWire Analysis
The framing of "patch your switches" undersells what's actually being disclosed here. Critical RCE in AOS-CX is not a peripheral issue. These switches sit at network chokepoints where visibility into all traffic is trivially achievable by anyone who controls the device.
What deserves more attention is the compounding risk from AOS-CX's programmability features. HPE built AOS-CX to be a platform, not just a switch — with open APIs, scripting support, and cloud management integration. That's genuinely useful for network operations teams. It's also genuinely useful for attackers who achieve initial access. A compromised AOS-CX switch with API access enabled can be scripted to exfiltrate traffic, manipulate routing, or pivot to adjacent management systems, all while looking like legitimate automation.
The 2023 Cisco IOS XE exploitation wave is the most instructive prior comparison. In that incident, attackers moved extremely quickly after public disclosure — compromising tens of thousands of devices within days. The organizations that got hit hardest were those that delayed patching because of change control friction. HPE network teams should treat this advisory as evidence that the window between disclosure and active exploitation is shrinking across the industry, not as reassurance that they have time.
For industries where AOS-CX is heavily deployed — particularly higher education and healthcare, which tend to run large campus switching footprints with under-resourced network teams — this should trigger an emergency review of both patching timelines and management interface exposure today.
The advisories will keep coming. The question is whether the patching culture inside network operations teams is evolving fast enough to keep up with the pace of discovery. Right now, the evidence suggests it is not.
— HackWire Editorial
---
## Related Coverage