HPE patches unauthenticated administrative-takeover flaws in the controller that manages Aruba switch…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
6
4 hosts
Action items (2)
Do-now tasks recorded on the entries about CVE-2026-76658, newest first. Check the date before acting on an older one.
Patch every HPE Networking Fabric Composer instance to 7.4.0 (or 7.3.4 on the 7.3 branch) now; until patched, remove the AFC API and web management interface from general-purpose networks onto a dedicated out-of-band management segment and restrict SSH access to the AFC host by source address, because CVE-2026-76658 needs no authentication.
Patch every ArubaOS-CX switch to its branch's fixed release (10.18.1002+ / 10.17.1030+ / 10.16.1060+ / 10.13.1190+ / 10.10.1181+; 10.10.x is past HPE's End of Maintenance and received only Critical-severity fixes); audit any switch left in factory-default or immediate post-ZTP state, since CVE-2026-73778's predictable admin password fully compromises a device before an administrator ever sets its own credentials.
trending-vulnerabilitiesHPE patches unauthenticated administrative-takeover flaws in the controller that manages Aruba switch fabrics, and a separate pre-auth RCE in ArubaOS-CX itself
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
HPE published two Aruba Networking security bulletins on 2026-09-01: HPESBNW05133 for HPE Networking Fabric Composer (AFC) and HPESBNW05134 for HPE Networking AOS-CX (HPE, HPESBNW05133, 2026-09-01) (HPE, HPESBNW05134, 2026-09-01). AOS-CX is HPE Aruba Networking's operating system for its enterprise network switches (BleepingComputer, 2026-09-03). The Fabric Composer bulletin lists 52 CVEs, two of them CVSS 10.0: CVE-2026-76658 is a flaw in AFC's SSH daemon that "could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts" and run arbitrary commands as a privileged user, "leading to complete system compromise" (HPE, HPESBNW05133, 2026-09-01), and CVE-2026-76657 is an API authentication bypass that lets an unauthenticated remote attacker circumvent the API's authentication controls and gain administrative privileges (HPE, HPESBNW05133, 2026-09-01). Three more rank Critical: CVE-2026-19766 (9.6, an authentication bypass in the underlying operating system that lets an unauthenticated adjacent attacker run code as a privileged user), CVE-2026-73701 (9.0, unauthenticated privileged code execution that depends on preconditions outside the attacker's control) and CVE-2026-73700 (9.0, stored cross-site scripting by an authenticated low-privilege operator against an administrator) (HPE, HPESBNW05133, 2026-09-01). HPE lists Fabric Composer 7.3.3 and below as affected, fixed in 7.4.0 and 7.3.4, and states that all of these flaws were found by its own internal security research (HPE, HPESBNW05133, 2026-09-01).
In AOS-CX, CVE-2026-73749 (CVSS 9.8) covers flaws in an AOS-CX daemon that an unauthenticated remote attacker triggers by sending specially crafted packets, reaching remote code execution with elevated privileges (HPE, HPESBNW05134, 2026-09-01) (BleepingComputer, 2026-09-03). HPE lists AOS-CX 10.18.0001, 10.17.1021 and below, 10.16.1051 and below, 10.13.1180 and below, and 10.10.1180 and below as affected, fixed in 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 and 10.10.1181 or later (HPE, HPESBNW05134, 2026-09-01). CERT-FR reads the 10.18 branch more broadly, as every 10.18.x release before 10.18.1002 (CERT-FR, 2026-09-02); the fix on that branch is 10.18.1002 either way. The 10.10 branch is past End of Maintenance and received fixes only for internally identified Critical-severity flaws, so CVE-2026-73749 is fixed there and the bulletin's lower-rated flaws are not (HPE, HPESBNW05134, 2026-09-01). The bulletin lists 33 further CVEs scored 4.9 to 8.8, among them an unauthenticated arbitrary file write through an API endpoint (CVE-2026-73752, 8.8, adjacent network), an unauthenticated format-string flaw in the CLI (CVE-2026-73782, 8.8, adjacent network), and a predictable factory-default password in the Credential Manager (CVE-2026-73778, 8.1) that gives an unauthenticated attacker full administrative control of a switch in factory-default or post-Zero-Touch-Provisioning state before an administrator sets credentials (HPE, HPESBNW05134, 2026-09-01). For both bulletins HPE states it is not aware of any public discussion or exploit code targeting the flaws as of the release date (HPE, HPESBNW05133, 2026-09-01) (HPE, HPESBNW05134, 2026-09-01).
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts.
Tracked as CVE-2026-73749, the security issue is a buffer overflow that allows unauthenticated remote attackers to send specially crafted packets to an affected daemon process, achieving code execution with elevated privileges.
The affected range recorded for CVE-2026-73749's 10.18 branch was inverted. BleepingComputer's reading of HPE's bulletin lists the branch as "10.18.0001 → upgrade to 10.18.1002+" (BleepingComputer, 2026-09-03), and CERT-FR lists every AOS-CX 10.18.x release before 10.18.1002 as affected (CERT-FR, 2026-09-02). 10.18.0001 is therefore an affected build, not the first fixed one, and the fix on that branch is 10.18.1002.
HPE's own bulletins correct several points. The Fabric Composer bulletin lists 52 CVEs, not the 45 in NCSC-NL's mirror (NCSC-NL, 2026-09-03), and names Fabric Composer 7.3.3 and below as affected, with no lower version bound (HPE, HPESBNW05133, 2026-09-01). The AOS-CX bulletin lists 34 CVEs, CVE-2026-73749 plus 33 others scored 4.9 to 8.8 (HPE, HPESBNW05134, 2026-09-01), more than the 23 further flaws BleepingComputer counted (BleepingComputer, 2026-09-03) and the 26 CVEs in NCSC-NL's advisory (NCSC-NL, 2026-09-03). For CVE-2026-73749 on the 10.18 branch, HPE lists 10.18.0001 as the affected build (HPE, HPESBNW05134, 2026-09-01) and CERT-FR reads the branch as every 10.18.x release before 10.18.1002 (CERT-FR, 2026-09-02). Either way the fix is 10.18.1002, and the earlier range of 10.18.0000 to 10.18.0001 did not come from HPE's bulletin. On the end-of-maintenance 10.10 branch only Critical-severity flaws were fixed, so the lower-rated AOS-CX flaws have no fix there (HPE, HPESBNW05134, 2026-09-01). HPE's exploitation statement is that it knows of no public discussion or exploit code, not a statement about active exploitation (HPE, HPESBNW05133, 2026-09-01). HPE titles CVE-2026-76658 an unauthenticated remote code execution in the Fabric Composer SSH daemon, not an authentication weakness (HPE, HPESBNW05133, 2026-09-01). The earlier takeaway described Fabric Composer's role without a cited source. It now rests on NCSC-NL's warning that an internet-reachable SSH management interface lets unauthenticated attackers take over the data-center network behind it (NCSC-NL, 2026-09-03).