CERT-FR Advisory: Multiple Vulnerabilities in HPE Aruba Networking Fabric Composer and VIA Allow RCE, DoS and Privilege Escalation
CERT-FR issued advisory CERTFR-2026-AVI-1451 on 04 November 2026 describing multiple vulnerabilities in HPE Aruba Networking products. Affected products include Fabric Composer versions 7.4.x prior to 7.4.1, Fabric Composer versions prior to 7.3.5, and Virtual Intranet Access (VIA) versions prior to 4.7.9. The flaws can allow an attacker to achieve remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality breaches, and security policy bypass. HPE published two corresponding security bulletins (HPESBNW05172 and HPESBNW05173) on 03 November 2026, and dozens of CVE identifiers are referenced in the advisory.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1451 covers more than 50 CVEs, CVE-2026-95722 through CVE-2026-95777, in HPE Aruba Networking Fabric Composer and Virtual Intranet Access (VIA). Depending on the flaw, an attacker could get remote code execution, privilege escalation, remote denial of service, a breach of data integrity or confidentiality, or a security policy bypass. The sources do not say which CVE causes which impact, nor what access, authentication or configuration each one needs. Affected versions are Fabric Composer 7.4.x before 7.4.1, Fabric Composer before 7.3.5, and VIA before 4.7.9. Fixes are in HPE bulletins HPESBNW05172 and HPESBNW05173, published on 3 November 2026.
Como foi descoberta
CERT-FR only says that multiple vulnerabilities were discovered in HPE Aruba Networking products. It does not say who found them or how. HPE published the two security bulletins on 3 November 2026, and CERT-FR issued its advisory on 4 November 2026. The sources do not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:25.
Detalhes técnicos
- Affected products: HPE Aruba Networking Fabric Composer (versions 7.4.x < 7.4.1, and versions < 7.3.5) and Virtual Intranet Access (VIA) (versions < 4.7.9).
- Impact: remote code execution, privilege escalation, remote denial of service, data confidentiality and integrity compromise, security policy bypass.
- Over 50 CVEs referenced, spanning CVE-2026-95722 through CVE-2026-95777.
- References: HPE security bulletins HPESBNW05172 and HPESBNW05173 (03 November 2026).
Remediação
- Apply the patches provided in HPE's security bulletins HPESBNW05172 and HPESBNW05173.
Linha do tempo
-
CERT-FR Advisory: Multiple Vulnerabilities in HPE Aruba Networking Fabric Composer and VIA Allow RCE, DoS and Privilege Escalation
ler a análise desta fonte ocultar
CERT-FR issued advisory CERTFR-2026-AVI-1451 on 04 November 2026 describing multiple vulnerabilities in HPE Aruba Networking products. Affected products include Fabric Composer versions 7.4.x prior to 7.4.1, Fabric Composer versions prior to 7.3.5, and Virtual Intranet Access (VIA) versions prior to 4.7.9. The flaws can allow an attacker to achieve remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality breaches, and security policy bypass. HPE published two corresponding security bulletins (HPESBNW05172 and HPESBNW05173) on 03 November 2026, and dozens of CVE identifiers are referenced in the advisory.
Technical Details
- Affected products: HPE Aruba Networking Fabric Composer (versions 7.4.x < 7.4.1, and versions < 7.3.5) and Virtual Intranet Access (VIA) (versions < 4.7.9).
- Impact: remote code execution, privilege escalation, remote denial of service, data confidentiality and integrity compromise, security policy bypass.
- Over 50 CVEs referenced, spanning CVE-2026-95722 through CVE-2026-95777.
- References: HPE security bulletins HPESBNW05172 and HPESBNW05173 (03 November 2026).
Remediation
- Apply the patches provided in HPE's security bulletins HPESBNW05172 and HPESBNW05173.