Reported by 3 outlets

Timeline

1. original reporting

   Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged User

   gbhackers.com · 41d ago · September 2nd, 2026

   Hewlett Packard Enterprise (HPE) has released security updates addressing 52 vulnerabilities in HPE Networking Fabric Composer, including two critical flaws that could allow unauthenticated remote attackers to gain administrative control or execute commands as a privileged operating-system user. These issues affect Fabric Composer versions 7.3.3 and earlier. HPE Fabric Composer Flaw The most severe vulnerability, […] The post Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged User appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Root

   cyberpress.org · 41d ago · September 2nd, 2026

   HPE Networking has released security updates for Fabric Composer following the disclosure of a broad set of vulnerabilities, including two maximum-severity flaws that could allow unauthenticated remote attackers to take administrative control of affected systems. The most severe issue, tracked as CVE-2026-76658, affects the product’s SSH daemon and can enable arbitrary command execution as a privileged operating system user, potentially resulting in a complete compromise of the Fabric Composer host. Critical HPE Fabric Composer Flaw HPE assigns CVSS v3.1 scores of 10.0 to both CVE-2026-76658 and CVE-2026-76657, reflecting network-reachable attack paths, low attack complexity, no authentication requirement, and high impact to confidentiality, integrity, and availability. CVE-2026-76658 is particularly urgent because it is located in Fabric Composer’s SSH daemon. According to HPE, an unauthenticated remote attacker could exploit the flaw to obtain administrative access to a vulnerable AFC host and execute arbitrary commands as a privileged user on the underlying operating system. While the advisory’s detailed description uses the term “privileged user” rather than explicitly stating “root,” the issue represents a high-risk host-compromise scenario. Administrators should treat the vulnerable manageme

3. update from socprime.com

   CVE-2026-76658: Critical HPE Fabric Composer Flaw Enables Unauthenticated Remote Code Execution

   socprime.com · 41d ago · September 2nd, 2026

   The vulnerability resides in the SSH daemon used by HPE Networking Fabric Composer, a platform designed to manage and automate data-center network fabrics. Successful exploitation can result in complete compromise of the affected management host, creating a potentially serious risk because the appliance may have privileged visibility into and control over network infrastructure. CVE-2026-76658 is one of dozens of security issues covered by HPE bulletin HPESBNW05133. Another flaw in the same release, CVE-2026-76657, also carries a CVSS score of 10.0 and can allow unauthenticated attackers to bypass API authentication and gain administrative privileges. At disclosure, HPE said it was not aware of public exploit code or public discussion targeting the newly patched vulnerabilities. According to HPE’s CVE descriptio