#HPE

HPE Fabric Composer Patches 52 Security Flaws Including Two Maximum-Severity RCE Bugs

Hewlett Packard Enterprise has released security updates addressing 52 vulnerabilities across HPE Networking Fabric Composer deployments running versions 7.3.3 and earlier. The massive batch of fixes includes two maximum-severity issues rated at CVSS 10.0 that allow unauthenticated remote attackers to take full control of the platform. The first critical flaw, tracked as `CVE-2026-76658`, stems from an authentication weakness inside the product's SSH daemon that allows arbitrary privileged command execution without requiring credentials or user interaction. The second CVSS 10.0 bug, identified as `CVE-2026-76657`, resides in the Fabric Composer API and lets remote attackers bypass authentication controls to gain administrative privileges. Three other vulnerabilities carry critical severity ratings, encompassing adjacent-network authentication bypasses and remote code execution flaws under `CVE-2026-19766`, `CVE-2026-73700`, and `CVE-2026-73701`. The broader advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities spanning SQL injection, arbitrary file writes, path traversal, broken access controls, and local privilege escalation. Many of these flaws allow attackers to execute code with root-level permissions or alter configuration states on systems managed by the fabric platform. HPE's internal networking security researchers discovered the entire collection of vulnerabilities. As of the September 1 advisory release, the vendor stated that no public exploit code or active exploitation had been observed in the wild. Organizations running affected deployments are advised to update the 7.3 release train to version 7.3.4 or upgrade directly to branch 7.4.0 or later. Unmaintained and end-of-support versions were not assessed and must be treated as vulnerable by default. For environments unable to patch immediately, HPE recommends isolating CLI and web management interfaces onto dedicated Layer 2 segments or VLANs protected by strict Layer 3 firewall policies.