This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] HPE fixes 37 vulnerabilities in its products
HPE fixes 37 vulnerabilities in Networking AOS-Switch and Networking ClearPass Policy Manager. The most severe of them are described below; you can find the rest at [1][2]. Individual products and their fixed versions: HPE Networking AOS-Switch – 16.11.0032 [1] HPE Networking ClearPass Policy Manager – 6.14.1, 6.11.16 [2]
An unauthenticated remote attacker can execute arbitrary code due to a buffer overflow in HPE Networking AOS-Switch [1].
The vulnerability is present in product:
- HPE Networking AOS-Switch; <16.11.0032
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-76744 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An unauthenticated remote attacker can bypass authentication in the web management interface of HPE Networking AOS-Switch and gain unauthorized access to the device [1].
The vulnerability is present in product:
- HPE Networking AOS-Switch; <16.11.0032
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-76742 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An unauthenticated remote attacker can execute arbitrary code due to deserialization of untrusted data in the web interface [2].
The vulnerability is present in product:
- HPE Networking ClearPass Policy Manager; >=6.14, <6.14.1; >=6.11, <6.11.16
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-76750 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An unauthenticated attacker from an adjacent network can execute arbitrary code due to memory corruption in HPE Networking AOS-Switch [1].
The vulnerability is present in product:
- HPE Networking AOS-Switch; <16.11.0032
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-76745 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An authenticated remote attacker with low privileges can carry out an SQL injection attack due to insufficient input sanitization in the web management interface of HPE Networking ClearPass Policy Manager [2].
The vulnerability is present in product:
- HPE Networking ClearPass Policy Manager; >=6.14, <6.14.1; >=6.11, <6.11.16
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-79798 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 7. 10. 2026.