This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HPE Aruba Networking fixes 86 vulnerabilities
HPE Aruba Networking fixes 86 vulnerabilities in its products [1][2]. The most severe vulnerabilities are listed below. Products and their fixed versions: HPE Networking Fabric Composer - 7.4.0, 7.3.4 [1] HPE Aruba Networking AOS-CX - 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181 [2]
An unauthenticated remote attacker can bypass authentication checks, gain administrative privileges and fully compromise the host system due to an authentication bypass vulnerability in the HPE Networking Fabric Composer API [1][3].
The vulnerability is present in product:
- HPE Networking Fabric Composer; >=7.0.0, <=7.3.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-76657 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 2. 9. 2026.
An unauthenticated remote attacker can gain administrative access and execute arbitrary commands with privileged permissions on the host operating system due to a vulnerability in the HPE Networking Fabric Composer SSH daemon, which may lead to full system compromise [1][4].
The vulnerability is present in product:
- HPE Networking Fabric Composer; >=7.0.0, <=7.3.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-76658 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
An unauthenticated remote attacker can execute arbitrary code with elevated privileges due to buffer overflow vulnerabilities when processing specially crafted packets in the AOS-CX daemon [2][5].
The vulnerability is present in product:
- AOS-CX; >=10.18.0, <10.18.1002; >=10.17.0, <10.17.1030; >=10.16.0, <10.16.1060; >=10.13.0, <10.13.1190; >=10.10.0, <10.10.1181
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-73749 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 2. 9. 2026.
An unauthenticated attacker on an adjacent network can execute arbitrary code with privileged permissions and fully compromise the host system due to an authentication bypass vulnerability in the HPE Networking Fabric Composer operating system [1][6].
The vulnerability is present in product:
- HPE Networking Fabric Composer; >=7.0.0, <=7.3.3
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-19766 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 2. 9. 2026.
An unauthenticated remote attacker can, under specific conditions, execute arbitrary code with privileged permissions in HPE Networking Fabric Composer and fully compromise the host system [1][7].
The vulnerability is present in product:
- HPE Networking Fabric Composer; >=7.0.0, <=7.3.3
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-73701 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 2. 9. 2026.
Links
- [1] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US
- [2] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US
- [3] https://nvd.nist.gov/vuln/detail/cve-2026-76657
- [4] https://nvd.nist.gov/vuln/detail/cve-2026-76658
- [5] https://nvd.nist.gov/vuln/detail/cve-2026-73749
- [6] https://nvd.nist.gov/vuln/detail/cve-2026-19766
- [7] https://nvd.nist.gov/vuln/detail/cve-2026-73701
By CESNET, z.s.p.o. Michaela Jarošová on 3. 9. 2026.