HPE Patches 55 Vulnerabilities Across Fabric Composer and Virtual Intranet Access (VIA), Including Critical Hardcoded Password Bug CVE-2026-95731 (CVSS 9.8)
HPE has disclosed 55 vulnerabilities across two HPE Networking products in two separate advisories published 3 November 2026: HPESBNW05172, covering 46 flaws in HPE Networking Fabric Composer (AFC), a tool used to automate and manage data center network fabrics; and HPESBNW05173, covering 9 flaws in the HPE Networking Virtual Intranet Access (VIA) VPN client (relayed by cert.cyber.gouv.fr). The most severe overall, CVE-2026-95731 (CVSS 9.8), is a hardcoded-password flaw in the Fabric Composer command-line interface that lets an unauthenticated remote attacker log in with built-in credentials and gain full administrative access. Two other critical Fabric Composer flaws, CVE-2026-95732 and CVE-2026-95733 (CVSS 9.6 each), allow an unauthenticated attacker on an adjacent network segment to execute arbitrary code, via an authentication bypass in the underlying operating system and hardcoded credentials in a component, respectively. Most of the 55 issues were found internally by HPE Networking's own security research team, with a handful credited to external researchers through HPE's bug bounty program, and HPE states it is not aware of any public exploit code or active exploitation targeting any of them.
Entenda a falha
A vulnerabilidade
HPE published two bulletins on 3 November 2026: HPESBNW05172 (46 flaws in HPE Networking Fabric Composer) and HPESBNW05173 (9 flaws in the VIA VPN client). The most severe is CVE-2026-95731 (CVSS 9.8), hardcoded credentials in the Fabric Composer CLI: an unauthenticated remote attacker can log in and get full administrative access. CVE-2026-95732 (authentication bypass in the underlying OS) and CVE-2026-95733 (hardcoded credentials in a component), both CVSS 9.6, let an unauthenticated attacker on the adjacent network run arbitrary code. Other issues: SQL injection from the adjacent network (CVE-2026-95748, 7.5), unauthenticated API denial of service (CVE-2026-95745), and admin-only command injection (CVE-2026-95756, 6.6). In VIA, CVE-2026-95722 (8.8) is a local privilege escalation, and CVE-2026-95724 (8.1) and CVE-2026-95726 (7.5) are remote. Affected: Fabric Composer 7.4.0 and below, 7.3.4 and below, and VIA 4.7.8 and below. Fixed in 7.4.1, 7.3.5 and VIA 4.7.9.
Como funciona
The articles give little step-by-step detail. For the critical CLI flaw, the Fabric Composer CLI accepts built-in credentials, so anyone who reaches it and presents them is treated as a legitimate administrator. For CVE-2026-95732 and CVE-2026-95733, a device on the same network segment reaches the OS authentication or a component that relies on embedded credentials, and the check fails to keep the attacker out, which leads to code execution. For the SQL injection (CVE-2026-95748), input from an adjacent attacker reaches database queries without safe handling. The sources do not describe the internal flow of the other flaws.
Por que é vulnerável
The articles point to several root causes: credentials embedded in the product (the CLI and a component), authentication checks that can be bypassed in the underlying OS, certificate validation that is not done properly (nine bugs), no limit on login attempts, and input reaching the database or a command without safe handling. Management interfaces exposed to untrusted networks make these worse. The sources do not explain the code-level reasons or why the bugs went unnoticed, nor what each fix changes beyond moving to the patched versions.
Como foi descoberta
According to the story, most of the 55 issues were found internally by HPE Networking's security research team, and a few were credited to external researchers through HPE's bug bounty program: m0omo0d for CVE-2026-95725 and Lucid_Duck for CVE-2026-95728. Securityonline.info says HPE's internal team found all 46 Fabric Composer flaws. HPE published the bulletins on 3 November 2026 and CERT-FR relayed them on 4 November. HPE says it is not aware of public discussion or exploit code, and no exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 19:06.
Detalhes técnicos
Fabric Composer (HPESBNW05172): the bulletin lists 3 critical, 20 high, 18 medium and 5 low-severity issues, 16 of which require no authentication at all. Beyond the three critical bugs, notable issues include nine improper certificate-validation flaws that can leak data, bypass authentication or allow interception of management traffic; authentication bypass bugs CVE-2026-95738 and CVE-2026-95746; a missing login-throttling flaw (CVE-2026-95739); an unauthenticated denial-of-service flaw in the API (CVE-2026-95745); seven privilege-escalation issues across local, API and SSH interfaces; an adjacent-network SQL injection flaw (CVE-2026-95748, CVSS 7.5); an admin-authenticated command injection flaw in the API (CVE-2026-95756, CVSS 6.6); and two flaws allowing audit-log bypass or spoofing. Because Fabric Composer manages the switches in a data center fabric, compromising it could give an attacker a path to the broader network infrastructure it controls.
Virtual Intranet Access (VIA) (HPESBNW05173, arubanetworking.hpe.com): affects the VIA client on all platforms, version 4.7.8 and below, with 7 High and 2 Medium-severity issues. The most severe, CVE-2026-95722 (CVSS 8.8), is a local privilege-escalation flaw allowing a low-privileged local attacker to execute arbitrary commands with elevated rights; related local issues include a missing integrity-verification bug (CVE-2026-95723, CVSS 8.4) and a Linux-specific command-injection flaw (CVE-2026-95725, CVSS 7.8, credited to researcher m0omo0d via HPE's bug bounty program). Two VIA flaws are remotely exploitable without authentication: CVE-2026-95724 (CVSS 8.1), an improper certificate-validation bug enabling authentication bypass and potential data disclosure (requires user interaction), and CVE-2026-95726 (CVSS 7.5), a buffer overflow causing denial of service. A local Linux privilege-escalation issue via arbitrary file write (CVE-2026-95728, CVSS 7.1) was credited to researcher Lucid_Duck. The remaining VIA issues (CVE-2026-95727, CVE-2026-95729, CVE-2026-95730) are lower-severity command injection, information disclosure and denial-of-service bugs requiring authentication or local/administrative access.
Remediação
The Fabric Composer flaws affect HPE Networking Fabric Composer 7.4.0 and below and 7.3.4 and below; HPE urges customers to upgrade to 7.4.1 or 7.3.5 or later, available via the HPE Networking Support Portal. The VIA flaws affect HPE Networking VIA client (all platforms) 4.7.8 and below; HPE recommends upgrading to 4.7.9 and above, also via the HPE Networking Support Portal (networkingsupport.hpe.com). No workaround is available for the VIA vulnerabilities. HPE notes that versions past End of Support should be considered potentially impacted for both products, though it does not evaluate or patch them. Until Fabric Composer is patched, HPE recommends restricting the CLI and web management interfaces to a dedicated Layer 2 segment/VLAN and/or controlling access with firewall policies at Layer 3 and above, as well as enabling logging of user activity.
Linha do tempo
-
HPE Patches 55 Vulnerabilities in Aruba Networking Fabric Composer and Virtual Intranet Access (VIA)
This CERT-FR advisory relays a second HPE Networking bulletin (HPESBNW05173) that was not covered by the prior report: it discloses 9 additional CVEs in the Virtual Intranet Access (VIA) client (version 4.7.8 and below, fixed in 4.7.9), including a high-severity local privilege-escalation flaw (CVE-2026-95722, CVSS 8.8) and two external researcher-credited bugs, alongside the previously known 46 Fabric Composer flaws.
ler a análise desta fonte ocultar
This CERT-FR advisory relays a second HPE Networking bulletin (HPESBNW05173) that was not covered by the prior report: it discloses 9 additional CVEs in the Virtual Intranet Access (VIA) client (version 4.7.8 and below, fixed in 4.7.9), including a high-severity local privilege-escalation flaw (CVE-2026-95722, CVSS 8.8) and two external researcher-credited bugs, alongside the previously known 46 Fabric Composer flaws.
CERT-FR has relayed two HPE Networking security bulletins published on 3 November 2026, covering 55 CVEs across two products: HPESBNW05172 for HPE Networking Fabric Composer (AFC) and HPESBNW05173 for HPE Networking Virtual Intranet Access (VIA). The advisories, originally issued by the vendor, describe flaws that can lead to remote code execution, privilege escalation, denial of service, data integrity and confidentiality breaches, and security-policy bypass. CERT-FR does not add its own analysis but points administrators to the HPE bulletins for the fixes.
Technical Details
Fabric Composer versions 7.4.x prior to 7.4.1 and versions prior to 7.3.5 are affected by 46 vulnerabilities, including the critical hardcoded-password flaw CVE-2026-95731 (CVSS 9.8) that lets an unauthenticated attacker log in via the CLI with full administrative rights, and the critical CVE-2026-95732/CVE-2026-95733 (CVSS 9.6) adjacent-network code-execution bugs (hpe.com/arubanetworking.hpe.com, previously documented). Virtual Intranet Access (VIA) client, all platforms, version 4.7.8 and below, is separately affected by 9 vulnerabilities disclosed in HPESBNW05173 (arubanetworking.hpe.com): 7 rated High and 2 rated Medium. The most severe, CVE-2026-95722 (CVSS 8.8), is a local privilege-escalation flaw allowing a low-privileged local attacker to execute arbitrary commands with elevated rights; related local issues include a missing integrity-verification bug (CVE-2026-95723, CVSS 8.4) and a Linux-specific command-injection flaw (CVE-2026-95725, CVSS 7.8, credited to researcher m0omo0d via HPE's bug bounty program). Two VIA flaws are remotely exploitable without authentication: CVE-2026-95724 (CVSS 8.1), an improper certificate-validation bug enabling authentication bypass and potential data disclosure (requires user interaction), and CVE-2026-95726 (CVSS 7.5), a buffer overflow causing denial of service. A local Linux privilege-escalation issue via arbitrary file write (CVE-2026-95728, CVSS 7.1) was credited to researcher Lucid_Duck. All other VIA flaws were found internally by HPE Networking's own security research team, and HPE states it is not aware of public exploit code or discussion targeting any of them.
Remediation
For Fabric Composer, HPE urges upgrading to 7.4.1 or 7.3.5 or later. For VIA, HPE Networking recommends upgrading to 4.7.9 and above; no workaround is available for the VIA flaws. Both fixes are available via the HPE Networking Support Portal (networkingsupport.hpe.com). HPE notes that software past End of Support should be considered potentially impacted even though it is not evaluated or patched by the vendor.
-
HPE Patches 46 Fabric Composer Flaws, Including Critical Hardcoded Password Bug CVE-2026-95731 (CVSS 9.8)
ler a análise desta fonte ocultar
HPE has disclosed 46 vulnerabilities in HPE Networking Fabric Composer (AFC), a tool used to automate and manage data center network fabrics, in advisory HPESBNW05172. The most severe, CVE-2026-95731 (CVSS 9.8), is a hardcoded-password flaw in the command-line interface that lets an unauthenticated remote attacker log in with built-in credentials and gain full administrative access. Two other critical flaws, CVE-2026-95732 and CVE-2026-95733 (CVSS 9.6 each), allow an unauthenticated attacker on an adjacent network segment to execute arbitrary code, via an authentication bypass in the underlying operating system and hardcoded credentials in a component, respectively. All 46 issues were found internally by HPE Networking's own security research team, and HPE states it is not aware of any public exploit code or active exploitation targeting them.
Technical Details
The bulletin lists 3 critical, 20 high, 18 medium and 5 low-severity issues, 16 of which require no authentication at all. Beyond the three critical bugs, notable issues include nine improper certificate-validation flaws that can leak data, bypass authentication or allow interception of management traffic; authentication bypass bugs CVE-2026-95738 and CVE-2026-95746; a missing login-throttling flaw (CVE-2026-95739); an unauthenticated denial-of-service flaw in the API (CVE-2026-95745); seven privilege-escalation issues across local, API and SSH interfaces; an adjacent-network SQL injection flaw (CVE-2026-95748, CVSS 7.5); an admin-authenticated command injection flaw in the API (CVE-2026-95756, CVSS 6.6); and two flaws allowing audit-log bypass or spoofing. Because Fabric Composer manages the switches in a data center fabric, compromising it could give an attacker a path to the broader network infrastructure it controls.
Remediation
The flaws affect HPE Networking Fabric Composer 7.4.0 and below and 7.3.4 and below. HPE urges customers to upgrade to 7.4.1 or 7.3.5 or later, available via the HPE Networking Support Portal. HPE notes that versions past End of Support should be considered potentially impacted, though it does not evaluate or patch them. Until patched, HPE recommends restricting the CLI and web management interfaces to a dedicated Layer 2 segment/VLAN and/or controlling access with firewall policies at Layer 3 and above, as well as enabling logging of user activity.