Swiss SME Cyber Alert: HPE Aruba switches – management interface exposed without sign-in
HPE has disclosed critical vulnerabilities in Aruba switches running AOS-S. An attacker can bypass the web management login or exploit another flaw to run code on the switch. Organisations using Aruba switches should ask their IT provider to verify promptly that AOS-S 16.11.0032 is installed.
What happened?
On 6 October 2026, HPE released a security update for AOS-S. CVE-2026-76742 allows an unauthenticated remote attacker to access the web management interface. CVE-2026-76744 covers buffer overflow flaws that allow an unauthenticated remote attacker to execute arbitrary code. Both vulnerabilities carry a CVSS score of 9.8.
Could my organisation be affected?
HPE Aruba switches running AOS-S 16.11.0031 or earlier are affected. These switches can be found in ordinary office, branch or training networks. The decisive factor is not only the hardware model but the AOS-S version actually installed.
What should you do now?
Ask your IT provider to check the switch inventory and firmware levels, then upgrade affected devices to AOS-S 16.11.0032 or later. Until the update is complete, HPE recommends restricting CLI and web management to a dedicated Layer 2 management segment or appropriate Layer 3 firewall policies.
How urgent is it?
Urgent. HPE is not aware of public discussion, exploit code or confirmed active exploitation at this time. However, because the critical attack paths require no sign-in and target switch management, the review should not wait for the next routine maintenance cycle.
Information for your IT provider
Advisory: HPESBNW05156. Critical CVEs: CVE-2026-76742 and CVE-2026-76744. Affected: AOS-S 16.11.0031 and earlier. Fixed in AOS-S 16.11.0032 and later. Restrict management access to dedicated networks until upgraded.
