Hewlett Packard Enterprise (HPE) has released security updates addressing 52 vulnerabilities in HPE Networking Fabric Composer, including two critical flaws that could allow unauthenticated remote attackers to gain administrative control or execute commands as a privileged operating-system user. These issues affect Fabric Composer versions 7.3.3 and earlier.
The most severe vulnerability, CVE-2026-76658, is an authentication weakness in the product’s SSH daemon. An attacker does not need any credentials, user interaction, or complex preparation to access vulnerable AFC hosts. HPE Fabric Composer Flaw
Successful exploitation allows arbitrary execution of privileged commands, potentially leading to complete compromise of the underlying host. HPE has assigned this vulnerability a CVSS score of 10.0 (CVSS 3.1).
The second vulnerability, rated 10.0, CVE-2026-76657, affects the Fabric Composer API. It enables a remote, unauthenticated adversary to bypass authentication controls, gain administrator privileges, and take full control of the system. Both vulnerabilities are exploitable over the network, have low complexity, and pose significant risks to confidentiality, integrity, and availability.
In addition, three other vulnerabilities are rated critical. CVE-2026-19766 allows an unauthenticated attacker on an adjacent network to bypass authentication and execute privileged code.
CVE-2026-73700 is a stored cross-site scripting flaw that enables a low-privilege operator to target an administrator. CVE-2026-73701 allows an unauthenticated user to remotely execute privileged code when certain preconditions outside the attacker’s control are met.
The remaining advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities. These include issues such as command execution and SQL injection, arbitrary file writes, broken access control, exposure of sensitive data, denial-of-service, path traversal, open redirects, request-attribution spoofing, and local privilege escalation.
Many of these vulnerabilities can lead to root-level code execution or unauthorized changes to systems managed by Fabric Composer, making exposed management interfaces appealing targets.
HPE reported that its internal networking security researchers discovered all these vulnerabilities. As of the advisory’s release on September 1, the company was aware of no public discussions or exploit code targeting these issues.
While this reduces the immediate evidence of active exploitation, it does not diminish the urgency of remediation due to the variety of attack vectors and the potential for unauthenticated compromise.
Administrators are advised to upgrade the Fabric Composer 7.3 branch to version 7.3.4 or later, or to move to version 7.4.0 or later. End-of-Maintenance released versions are presumed affected, while End-of-Support deployments have not been assessed and should be treated as potentially vulnerable.
Until patching is complete, HPE recommends placing the CLI and web management interfaces on a dedicated Layer 2 segment or VLAN and restricting access with Layer 3 firewall policies. Additionally, teams should review logs for unusual SSH, API, and administrator activity and rotate exposed credentials if a compromise is suspected.
CVE Details
| CVE | Vulnerability | Severity | CVSS |
|---|---|---|---|
| CVE-2026-76657 | API authentication bypass grants administrative access | Critical | 10.0 |
| CVE-2026-76658 | Unauthenticated RCE in SSH daemon | Critical | 10.0 |
| CVE-2026-19766 | Adjacent-network authentication bypass and privileged code execution | Critical | 9.6 |
| CVE-2026-73700 | Authenticated stored XSS in management interface | Critical | 9.0 |
| CVE-2026-73701 | Unauthenticated privileged RCE with preconditions | Critical | 9.0 |
| CVE-2026-73702 | Authenticated API privilege escalation | High | 8.8 |
| CVE-2026-73703 | Adjacent-network stored XSS | High | 8.8 |
| CVE-2026-73704 | Authenticated API command injection | High | 8.8 |
| CVE-2026-73705 | Arbitrary file write leading to RCE | High | 8.8 |
| CVE-2026-73706 | API authentication bypass, data exposure and unauthorized changes | High | 8.6 |
| CVE-2026-73707 | API broken access control and privilege escalation | High | 8.5 |
| CVE-2026-73708 | Business-logic flaw exposing sensitive information | High | 8.3 |
| CVE-2026-73709 | Adjacent-network RCE during installation | High | 8.3 |
| CVE-2026-73710 | Unauthenticated API denial of service | High | 8.2 |
| CVE-2026-73711 | Improper privilege assignment grants administrative access | High | 8.1 |
| CVE-2026-73712 | Unauthenticated API remote code execution | High | 8.1 |
| CVE-2026-73713 | Local privilege escalation to root | High | 7.8 |
| CVE-2026-73714 | Authenticated API information disclosure | High | 7.6 |
| CVE-2026-73715 | Unauthenticated API denial of service | High | 7.5 |
| CVE-2026-73716 | Unauthenticated privileged RCE requiring interaction/preconditions | High | 7.5 |
| CVE-2026-73717 | Unauthenticated management-interface command injection | High | 7.5 |
| CVE-2026-73718 | Web-interface sensitive information disclosure | High | 7.4 |
| CVE-2026-73719 | Administrative arbitrary file write leading to root RCE | High | 7.2 |
| CVE-2026-73720 | Insecure API file handling leading to RCE | High | 7.2 |
| CVE-2026-73721 | Authenticated API SQL injection | High | 7.2 |
| CVE-2026-73722 | Authenticated management-interface command injection | High | 7.2 |
| CVE-2026-73723 | Privilege escalation enabling unauthorized state changes | High | 7.1 |
| CVE-2026-73724 | Broken access control enabling settings changes | High | 7.1 |
| CVE-2026-73725 | Local privilege escalation and root code execution | High | 7.0 |
| CVE-2026-73726 | Adjacent-network authentication bypass | Medium | 6.8 |
| CVE-2026-73727 | Authenticated API information disclosure | Medium | 6.5 |
| CVE-2026-73728 | Authenticated API denial of service | Medium | 6.5 |
| CVE-2026-73729 | Local authenticated information disclosure | Medium | 6.5 |
| CVE-2026-73730 | Authenticated API privilege escalation | Medium | 6.5 |
| CVE-2026-73731 | Unauthenticated reflected XSS | Medium | 6.1 |
| CVE-2026-73732 | Local sensitive information disclosure | Medium | 5.6 |
| CVE-2026-73733 | API authentication bypass allowing continued access | Medium | 5.4 |
| CVE-2026-73734 | Unauthenticated open redirect | Medium | 5.4 |
| CVE-2026-73735 | API access-control flaws exposing information | Medium | 5.4 |
| CVE-2026-73736 | Unauthenticated limited information disclosure | Medium | 5.3 |
| CVE-2026-73737 | Adjacent-network API path traversal and file modification | Medium | 4.8 |
| CVE-2026-73738 | Local authenticated information disclosure | Medium | 4.7 |
| CVE-2026-73739 | Local authenticated API information disclosure | Medium | 4.4 |
| CVE-2026-73740 | Local privilege escalation | Medium | 4.4 |
| CVE-2026-73741 | Authenticated API limited file read | Medium | 4.3 |
| CVE-2026-73742 | Client-address validation flaw enables attribution spoofing | Medium | 4.3 |
| CVE-2026-73743 | Unauthenticated information disclosure | Low | 3.7 |
| CVE-2026-73744 | Authenticated management-interface denial of service | Low | 3.5 |
| CVE-2026-73745 | Unauthenticated limited API information disclosure | Low | 3.1 |
| CVE-2026-73746 | Authenticated API denial of service | Low | 3.1 |
| CVE-2026-73747 | Local privilege escalation | Low | 2.5 |
| CVE-2026-73748 | Authenticated information disclosure | Low | 2.2 |
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…