CVE-2026-76657 & CVE-2026-76658 (CVSS 10.0): Twin Maximum-Severity HPE Fabric Composer Flaws Put Your Network Management Plane at Risk

Two simultaneous CVSS 10.0 vulnerabilities in HPE Networking Fabric Composer — your organisation’s nerve centre for composable network infrastructure — mean an unauthenticated attacker with nothing more than IP reachability can gain full administrative control and execute arbitrary commands as root on the management host. Disclosed on 1 September 2026, these flaws carry the highest possible severity score and require zero credentials, zero user interaction, and zero complex preparation. If your HPE Fabric Composer deployment is reachable from any user, server, or shared enterprise network segment, it is exposed right now.

What Is HPE Networking Fabric Composer — and Why Does It Matter?

HPE Networking Fabric Composer (AFC) is the centralised orchestration and automation layer for HPE Aruba composable campus and data-centre fabrics. It acts as the single pane of glass from which network administrators configure, provision, and monitor HPE Aruba switches, manage topologies, push policy, and automate lifecycle operations. In enterprise environments — particularly those running HPE Aruba CX switching at scale — AFC is not a peripheral tool; it is the management plane.

That architectural centrality is exactly what makes these vulnerabilities so alarming. Control AFC, and you effectively control the switches it manages: VLANs, ACLs, routing, segmentation policies, and the ability to create new admin accounts or exfiltrate network topology maps. For Indian enterprises running HPE Aruba infrastructure in banking, healthcare, manufacturing, or government networks, the blast radius of a successful exploit is enormous.

Technical Breakdown: CVE-2026-76657 & CVE-2026-76658

HPE’s security bulletin HPESBNW05133 covers both flaws alongside several lower-severity issues patched in the same release cycle. The two critical vulnerabilities each receive the maximum CVSSv3.1 base score of 10.0, an outcome driven by the intersection of four factors: network-reachable attack vector, low complexity, no privileges required, and maximum impact across confidentiality, integrity, and availability.

CVE-2026-76657 — API Authentication Bypass

This flaw resides in AFC’s REST API layer. The authentication enforcement logic contains a bypass that allows a remote, unauthenticated attacker to circumvent access controls entirely and obtain administrative privileges over the Fabric Composer management interface. Once admin access is obtained, an attacker can read the full network topology, modify switch configurations, create or delete administrator accounts, extract credentials, and push malicious policy to every managed switch in the fabric — all through legitimate AFC API calls that appear authorised in the audit log.

CVE-2026-76658 — SSH Daemon Remote Code Execution

CVE-2026-76658 is an operating-system-level vulnerability. It affects the SSH daemon bundled with HPE Fabric Composer and allows an unauthenticated remote attacker to execute arbitrary commands with the privileges of a high-privilege OS user — effectively root on the management host. Unlike the API bypass, which grants control of the AFC application, this flaw gives an attacker a shell on the underlying server, opening paths to lateral movement, persistence mechanisms (cron jobs, systemd units, SSH authorised-keys implants), and data exfiltration that survive even a full AFC reinstallation.

Detail	CVE-2026-76657	CVE-2026-76658
CVSS v3.1 Score	10.0 (Critical)	10.0 (Critical)
Attack Vector	Network	Network
Privileges Required	None	None
User Interaction	None	None
Component Compromised	AFC REST API / admin interface	AFC host OS (root shell)
Affected Versions	AFC ≤ 7.3.3	AFC ≤ 7.3.3
Fixed Version	7.3.4 / 7.4.0	7.3.4 / 7.4.0

Sources: CyberSecurityNews, GBHackers, Security Online.

The Management Plane Is the Crown Jewel — and the Most-Neglected Attack Surface

In India and across Asia-Pacific, enterprises frequently deploy network management platforms like HPE Fabric Composer on flat or semi-flat internal networks, reachable from user VLANs, server segments, or shared corporate Wi-Fi. This is a well-known anti-pattern, yet operational convenience persistently wins over segmentation discipline. The attacker’s calculus is straightforward: instead of compromising hundreds of individual switches one by one, target the management system that controls them all.

This is the same strategic logic that drove adversaries to target SonicWall SMA 1000 appliances and that enabled the Fire Ant APT group to pivot across critical networks via compromised Cisco IOS XR management planes. The management-plane threat is not theoretical — it is the dominant attack pattern of 2026. Fabric Composer’s two CVSS 10.0 flaws make it the highest-priority target in any HPE Aruba environment right now.

The additional third vulnerability disclosed in the same HPE bulletin — a CVSS 9.8 flaw in HPE AOS-CX network switches — compounds the risk: switch-level exploitation becomes trivially chained from an AFC compromise, providing attackers with both north-south and east-west propagation paths through the fabric.

What You Should Do Right Now

Patch immediately. There is no substitute. Update HPE Networking Fabric Composer to version 7.3.4 (for deployments on the 7.3 branch) or 7.4.0. HPE’s advisory HPESBNW05133 provides the authoritative patch download links and upgrade guidance.

If you cannot patch immediately, the only effective compensating control for CVE-2026-76658 is network-level filtering. Restrict access to the AFC management port and SSH service to an explicit allowlist of administrator source IPs or networks — ideally from a dedicated, air-gapped or tightly segmented out-of-band management VLAN. This applies broadly to both vulnerabilities: neither requires a logged-in user to click anything, so application-layer controls are insufficient. Firewall rules at the network boundary are your interim line of defence.

Here is the prioritised action checklist Sanjay recommends for every HPE Aruba environment:

1. Inventory: Identify all AFC instances in your environment. Include virtual appliances, cloud-managed deployments, and branch installations. Version information is available at System > About in the AFC UI or via the show version API call.
2. Segment before you patch: If the management server is reachable from user or server VLANs, immediately apply firewall ACLs to restrict access. Zero-trust mandates that management-plane access originates only from authorised jump hosts or PAM (Privileged Access Management) systems.
3. Patch to 7.3.4 or 7.4.0: Follow HPE’s upgrade guide. Validate the cryptographic hash of the installer before applying. Test in a staging environment if your change-management process allows — but do not let CAB delays stretch past 72 hours on CVSS 10.0 disclosures.
4. Rotate credentials: After patching, rotate all AFC administrator passwords and API tokens. CVE-2026-76657 grants unauthenticated API access — assume any credentials transmitted to or stored in AFC may have been observed if the system was exposed before patching.
5. Review audit logs: Check AFC and SSH daemon logs for unexpected authentication attempts, admin account creation events, configuration changes, or API calls from unfamiliar source IPs in the past 30–90 days. Threat actors routinely pre-position before full exploitation.
6. Enable MFA on AFC admin accounts: Multi-factor authentication will not prevent the unauthenticated bypass (CVE-2026-76657 works without any credentials), but it will limit the usefulness of any credentials exfiltrated during a compromise window.
7. Patch AOS-CX switches too: The accompanying CVSS 9.8 flaw in HPE AOS-CX is part of the same advisory. Treat it as an extension of the same patch window.

The Zero-Trust Lens: Why Implicit Trust in the Management Plane Fails

Both vulnerabilities illuminate a foundational zero-trust principle that is still widely violated: management-plane systems must never be treated as implicitly trusted simply because they reside inside the enterprise perimeter. An API authentication bypass is catastrophic precisely because the perimeter — an internal network segment — is the only layer of protection the organisation was relying on. When that perimeter is breached (or when a threat actor is already inside, as is routinely the case in advanced persistent threat scenarios), there is no second factor.

Mature zero-trust architectures apply the same verify-explicitly, least-privilege, assume-breach principles to management traffic as they do to user traffic: authenticated, authorised, logged, and anomaly-monitored. Network orchestrators like Fabric Composer should be positioned behind a PAM solution that brokers access, records full session video, and enforces just-in-time privilege elevation. Every API call should carry a verifiable identity. SSH access should require certificate-based authentication — not passwords, and certainly not an open daemon reachable without credentials.

Frequently Asked Questions

Is CVE-2026-76657 or CVE-2026-76658 being actively exploited in the wild?

As of 4 September 2026, HPE has stated it is not aware of public proof-of-concept exploit code or active exploitation targeting either vulnerability. However, the attack complexity for both is rated Low — meaning no specialised knowledge or tooling is required. Historical patterns show that maximum-severity flaws in enterprise network management platforms attract exploit activity within days to weeks of disclosure, particularly once security researchers begin publishing technical analysis. The window to patch before weaponisation is open, but it is closing.

Which versions of HPE Fabric Composer are affected?

All versions of HPE Networking Fabric Composer up to and including 7.3.3 are affected by both CVE-2026-76657 and CVE-2026-76658. The fixed versions are 7.3.4 (for deployments staying on the 7.3 branch) and 7.4.0. If you are running a version earlier than 7.3, upgrade to 7.4.0 as the supported remediation path.

Does restricting SSH access fully mitigate CVE-2026-76658?

Network-level filtering — blocking inbound SSH (typically port 22) to the AFC host from all sources except an allowlisted management IP range — is an effective compensating control that eliminates the network-accessible attack path for CVE-2026-76658. It does not fix the underlying vulnerability, and it relies on the firewall policy remaining correctly enforced. It should be treated as a temporary bridge, not a substitute for patching. CVE-2026-76657 (the API bypass) may expose a different port; ensure your ACLs restrict all AFC management traffic, not only SSH.

How does this relate to the broader management-plane threat trend in 2026?

Network management systems have become the primary target for sophisticated adversaries in 2026. We have seen this pattern with SonicWall SMA appliances, Citrix NetScaler, and China-nexus APT groups targeting IOS XR routers — all management or edge control-plane systems. Attackers understand that compromising the orchestration layer provides leverage over the entire fabric it controls. Organisations must shift from treating management platforms as trusted internal infrastructure to applying the same rigorous access controls, vulnerability management, and monitoring they would apply to internet-facing systems.

---

Secure Your Network Before Attackers Do

CVE-2026-76657 and CVE-2026-76658 are a reminder that maximum-severity vulnerabilities do not knock before entering — and that the management plane, often the least-monitored part of the enterprise network, is exactly where well-resourced attackers focus. Whether you are running HPE Aruba fabrics, Cisco, Fortinet, or a mixed-vendor environment, the management-plane security posture of your organisation deserves dedicated review.

Sanjay Seth and the P J Networks team specialise in network security architecture, zero-trust design, and vulnerability response for enterprise and critical infrastructure clients across India. If you need help assessing your management-plane exposure, validating your patch status, or designing a zero-trust management architecture that eliminates implicit trust from your fabric, schedule a consultation today.

Sources used in this article: HPE Security Bulletin HPESBNW05133 · CyberSecurityNews · GBHackers · Security Online · nFlo Threat Intelligence