HPE Fabric Composer Patches 52 Vulnerabilities: Two CVSS 10.0 Flaws Enable Unauthenticated Full Takeover

HPE issued an emergency advisory patching 52 vulnerabilities in Aruba Networking Fabric Composer. API auth bypass and SSH daemon bypass both score CVSS 10.0. Unauthenticated attackers can fully take over the host. Versions 7.3.3 and earlier are affected.

On September 1, HPE published emergency security advisory HPESBNW05133, patching 52 vulnerabilities in HPE Fabric Composer (AFC) in a single release. Five are critical: API authentication bypass and SSH daemon management-access bypass both score CVSS 10.0. Unauthenticated remote attackers can obtain administrator privileges and fully take over the host. Versions 7.3.3 and earlier are affected.

Incident Overview

HPE Aruba Networking Fabric Composer is the control platform for managing and automating data-center network fabrics. The advisory covers the OS, SSH daemon, Web management UI, and API endpoints. The five critical/high issues:

• CVE-2026-76657 — API authentication bypass, CVSS 10.0
• CVE-2026-76658 — SSH daemon management-access bypass, CVSS 10.0
• CVE-2026-19766 — adjacent-network authentication bypass with privileged command execution, CVSS 9.6
• CVE-2026-73701 — unauthenticated remote code execution under specific conditions, CVSS 9.0
• CVE-2026-73700 — stored XSS in the Web management UI, CVSS 9.0

Technical Details

CVE-2026-76657 lets a remote attacker bypass existing API authentication and obtain administrator access without valid credentials. CVE-2026-76658 affects the product SSH daemon: an unauthenticated remote attacker can execute arbitrary commands on the underlying OS as a privileged user. Combined, AFC hosts have two independent full-takeover paths. The advisory also patches command injection, arbitrary file write, SQL injection, information disclosure, privilege escalation, and denial of service. Several issues can be chained: e.g., use an info-leak to map internal services, then auth bypass or RCE for full control. HPE stated that at advisory publication, no public exploit code or related discussion had been observed.

Impact Assessment

AFC sits on the network management plane, not a single application server. Compromise lets an attacker change VLAN, ACL, and routing config across the entire fabric, redirect traffic, and persist at the infrastructure layer — mostly outside EDR visibility. Risk is especially high for finance, telecom, energy, and large manufacturing organizations built on HPE/Aruba.

Remediation

• Upgrade immediately to 7.4.0 or later (7.4 branch), or 7.3.4 or later on the 7.3 branch. One update covers all 52 issues.
• Isolate AFC API, Web, and SSH management interfaces onto a dedicated management VLAN or out-of-band network. Restrict source access with L3 firewall policy.
• Audit administrator account lists; remove unused and shared accounts. Review auth logs for successful admin logins originating outside the management segment.
• Diff current Fabric config against baseline. Unauthorized VLAN, ACL, or routing changes are the most likely intrusion artifacts.

References

• CVE-2026-76657 details page
• CVE-2026-76658 details page
• HPE Fabric Composer CVSS 10.0 vulnerability analysis