Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

HPE Fabric Composer allows remote attackers to take admin control

CVE-2026-76658 · published 2 months ago
Summary

The SSH service in HPE Fabric Composer can be tricked by someone on the internet to log in without a password and become an administrator. This would let the attacker run any command on the server and take full control. Apply the latest security update from HPE and limit SSH access to trusted networks until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) fabric composer <= 7.3.3
arubanetworks fabric_composer <= 7.3.3
cpe:2.3:a:arubanetworks:fabric_composer:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Su...
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen1 Sep 2026
Sources
CVE-2026-76658 · NVD
CVE-2026-76658 · MITRE
Track software like this
Free during beta