HPE Fabric Composer Patches 52 Security Flaws Including Two Maximum-Severity RCE Bugs
Hewlett Packard Enterprise has released security updates addressing 52 vulnerabilities across HPE Networking Fabric Composer deployments running versions 7.3.3 and earlier. The massive batch of fixes includes two maximum-severity issues rated at CVSS 10.0 that allow unauthenticated remote attackers to take full control of the platform. The first critical flaw, tracked as `CVE-2026-76658`, stems from an authentication weakness inside the product's SSH daemon that allows arbitrary privileged command execution without requiring credentials or user interaction. The second CVSS 10.0 bug, identified as `CVE-2026-76657`, resides in the Fabric Composer API and lets remote attackers bypass authentication controls to gain administrative privileges. Three other vulnerabilities carry critical severity ratings, encompassing adjacent-network authentication bypasses and remote code execution flaws under `CVE-2026-19766`, `CVE-2026-73700`, and `CVE-2026-73701`. The broader advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities spanning SQL injection, arbitrary file writes, path traversal, broken access controls, and local privilege escalation. Many of these flaws allow attackers to execute code with root-level permissions or alter configuration states on systems managed by the fabric platform. HPE's internal networking security researchers discovered the entire collection of vulnerabilities. As of the September 1 advisory release, the vendor stated that no public exploit code or active exploitation had been observed in the wild. Organizations running affected deployments are advised to update the 7.3 release train to version 7.3.4 or upgrade directly to branch 7.4.0 or later. Unmaintained and end-of-support versions were not assessed and must be treated as vulnerable by default. For environments unable to patch immediately, HPE recommends isolating CLI and web management interfaces onto dedicated Layer 2 segments or VLANs protected by strict Layer 3 firewall policies.
Commentary
A dual CVSS 10.0 advisory affecting a core datacenter orchestration platform is about as severe as infrastructure security gets. HPE Fabric Composer sits at the convergence point of compute and network fabrics, meaning a compromise of the orchestration appliance effectively compromises the underlying switching topology and adjacent hosts. The presence of an unauthenticated authentication bypass in the SSH daemon (`CVE-2026-76658`) combined with an unauthenticated API administrative takeover (`CVE-2026-76657`) represents a total breakdown of perimeter controls on the appliance. When a management tool suffers from 52 distinct vulnerabilities discovered simultaneously by internal researchers, it points to a legacy codebase undergoing its first comprehensive secure-code review rather than isolated edge-case regressions. Any organization managing Aruba CX or HPE data-center fabrics via Fabric Composer <= 7.3.3 is affected. Upgrading to 7.3.4 or 7.4.0+ must take immediate priority. In the interim, network engineering teams should immediately verify that Fabric Composer management interfaces are strictly unreachable from transit VLANs, corporate workstation subnets, and out-of-band management jump hosts without strict ACL enforcement.
The Quote to Remember
“The most severe vulnerability, CVE-2026-76658, is an authentication weakness in the product’s SSH daemon. An attacker does not need any credentials, user interaction, or complex preparation to access vulnerable AFC hosts.”