EUVD-2026-69476
GHSA-p9f5-2p99-3r74
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AFC SSH daemon over network
-
DeliveryExploit SSH auth flaw unauthenticated
-
ExploitGain privileged administrative session
-
ExecutionExecute arbitrary OS commands
-
ImpactFull host and fabric compromise
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the SSH daemon of an HPE Networking Fabric Composer (AFC) host; per CVSS PR:N/UI:N no authentication and no user interaction are needed against affected versions. The primary limiting factor is exposure of the appliance's SSH management service to the attacker - deployments that confine AFC administration to an isolated management network are reachable only by attackers who already have access to that segment, which meaningfully narrows the realistic attack population even though the flaw itself needs no special product configuration. |
| Impact | This is a genuine top-priority issue rather than an inflated high-CVSS score: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality/integrity/availability impact plus scope change - the textbook 10.0 profile, and it is internally consistent with the description of unauthenticated remote admin access via SSH. No EPSS probability, KEV listing, or POC signal was supplied, so I cannot corroborate real-world exploitation activity; the score therefore reflects potential severity, not observed attacks. Because the vulnerable service is an administrative SSH daemon that should never be internet-exposed, real risk hinges heavily on network exposure, and even a mid-sized municipal IT team in sopot running an internet-reachable AFC management interface should treat this as urgent and patch immediately. Absent EPSS/KEV/POC data, defenders should assume the flaw is highly attractive to attackers given its trivial exploitability and treat it as imminently exploitable once details or tooling circulate. |
| Exploit ScenarioDerived | An attacker who can reach the AFC appliance's SSH port over the network connects to the SSH daemon and, without any credentials, obtains administrative access to the host. They then run arbitrary commands as a privileged user to deploy implants, alter or disable the managed network fabric, and pivot deeper into the data-center environment. No public exploit code was identified at time of analysis, but the low attack complexity makes weaponization straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
RemediationAI
Apply the fixed release identified in HPE Security Bulletin hpesbnw05133en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US); the input does not include an exact fixed version number, so treat this as patch available per vendor advisory and pull the precise target build from that bulletin before upgrading. Until the appliance is patched, reduce exposure by restricting network reachability of the AFC SSH/management service to a dedicated, tightly firewalled management VLAN or jump host and blocking SSH (TCP/22) to the appliance from untrusted and internet-facing networks - trade-off: legitimate remote administration must then traverse the bastion, adding operational friction. Because the vulnerability is in the SSH daemon itself, host-level access controls (source-IP allowlists / management-plane ACLs) are more effective than SSH-config tweaks, and any exposed instance should be audited for signs of unauthorized administrative access before and after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer (formerly Aruba Fabric Composer, AFC) is an orchestration and lifecycle-management platform for data-center network fabrics built on Aruba CX switches, typically deployed as a virtual appliance/host. The flaw resides in the appliance's SSH daemon, meaning the exposed management service handling remote administrative sessions is the attack surface. The CVSS scope change (S:C) reflects that compromise of the SSH service pivots to arbitrary command execution on the underlying operating system, escaping the confines of the vulnerable component. No CWE was assigned in the source data, so the precise root-cause class (e.g., authentication bypass vs. injection in the SSH auth path) cannot be stated with certainty; the CPE identifies the affected product as cpe:2.3:a:hewlett_packard_enterprise_(hpe):fabric_composer:*:*:*:*:*:*:*:*.
Know when Fabric Composer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-facing SSH daemon yields low-complexity privileged RCE (PR:N/AC:L); compromise pivots from the SSH service to the underlying OS, justifying S:C and full C/I/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
Executive ViewAI
HPE Aruba Fabric Composer appliances can be remotely compromised by unauthenticated attackers who gain direct administrative access to execute arbitrary system commands. This critical vulnerability (CVSS 10.0) threatens the security of your network fabric management infrastructure and all dependent network systems, with complete appliance takeover possible from the network edge. Immediate protective measures are required while HPE develops and releases a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately restrict network access to Fabric Composer appliances via firewall rules and ACLs, allowing SSH only from trusted administrative networks; (2) Isolate appliances to dedicated VLANs with strict ingress/egress controls; (3) Deploy intrusion detection monitoring for SSH brute-force and exploitation attempts; (4) If operationally feasible, disable SSH and use alternative management interfaces; (5) Maintain continuous engagement with HPE support for patch status and release timelines.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fabric Composer
View allAuthentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent netwo
Exploit-DB