Hewlett Packard Enterprise Hpe
Monthly
Buffer overflow conditions in an underlying network service of HPE AOS-CX allow unauthenticated attackers on the adjacent network segment to crash the device by sending specially crafted packets, causing a denial-of-service disruption to normal OS operation. This vulnerability is one of several disclosed together under HPE advisory hpesbnw05134, affecting the CX series switch OS. No public exploit code or active exploitation has been identified at time of analysis.
Access control bypass in the HPE AOS-CX API endpoint allows a highly-privileged remote attacker to circumvent the device's configured access control policy and reach management functionality that should be restricted to a higher administrative tier. Affected devices include HPE switches running AOS-CX, as confirmed by HPE in advisory hpesbnw05134, which also covers four other AOS-CX CVEs in the same release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Authenticated path traversal in HPE AOS-CX's web-based management interface permits a low-privileged authenticated attacker to read arbitrary files from the underlying operating system, potentially exposing credentials, private keys, and device configuration data. The CVSS vector (AV:N/AC:L/PR:L) confirms the vulnerability is remotely exploitable with minimal complexity once valid credentials are obtained. This CVE is part of a broader HPE security advisory (hpesbnw05134) covering multiple AOS-CX vulnerabilities, including higher-severity unauthenticated RCE issues, making credential exposure via this flaw a plausible stepping-stone in a multi-stage attack chain. No public exploit identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in the HPE AOS-CX web-based management interface allows an authenticated attacker with low-privilege credentials to force the switch to issue arbitrary internal HTTP requests, exposing the internal network topology and enabling limited modification of sensitive information. The vulnerability carries a Scope:Changed CVSS designation because the forged requests cross the trust boundary from the management plane into internal infrastructure the attacker cannot otherwise reach. This is the fifth CVE bundled in HPE advisory hpesbnw05134en_us alongside more severe issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string RCE (CVE-2026-73782, CVSS 8.8). No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Denial of service in HPE Integrated Lights-Out 6 (iLO 6) firmware prior to v1.78 allows an unauthenticated attacker on an adjacent network segment to render the management interface unavailable. The impact is limited to availability (A:H) with no confidentiality or integrity compromise, but disrupting iLO can blind administrators to server state and block out-of-band recovery operations during incidents. No public exploit or active exploitation has been identified at time of analysis; HPE has released v1.78 as the fix.
Sensitive cryptographic material on HPE Networking Instant On 1830, 1930, and 1960 switches is exposed to remote network actors through an information disclosure vulnerability. Exploitation allows retrieval of cryptographic secrets such as private keys, certificates, or pre-shared credentials, which could subsequently enable man-in-the-middle attacks, traffic decryption, or device impersonation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Session persistence in HPE Aruba Networking Wireless Operating System (AOS-8) allows an attacker who has obtained valid user credentials to retain network access even after an administrator has disabled the associated account. The flaw affects AOS versions across the 8.10, 8.12, and 8.13 branches and stems from the platform's failure to invalidate active sessions upon credential revocation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.03% at the 10th percentile, placing this squarely in the low-real-world-risk tier despite its medium CVSS score.
Sensitive OS file disclosure in the HPE Aruba Networking AOS-10 Gateway web management interface allows authenticated remote administrators to read arbitrary files on the underlying operating system. Affected version ranges span AOS 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, and 10.8.0.0. No public exploit code exists and EPSS sits at 0.03% (11th percentile), with SSVC confirming no observed exploitation - risk is primarily from compromised admin credentials or insider threats rather than opportunistic attack.
XML entity expansion (CWE-776) in the DHCP XML handling component of HPE Aruba AOS Instant 8.x.x.x enables an unauthenticated remote attacker to cause denial-of-service via excessive resource consumption on affected Access Points. Exploitation requires both high attack complexity and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), restricting the realistic attack surface to scenarios where a connected wireless client triggers the vulnerable DHCP parsing path. No active exploitation has been identified - EPSS stands at 0.07% (21st percentile), SSVC confirms exploitation status of none, and the vulnerability is absent from CISA KEV.
Buffer overflow conditions in an underlying network service of HPE AOS-CX allow unauthenticated attackers on the adjacent network segment to crash the device by sending specially crafted packets, causing a denial-of-service disruption to normal OS operation. This vulnerability is one of several disclosed together under HPE advisory hpesbnw05134, affecting the CX series switch OS. No public exploit code or active exploitation has been identified at time of analysis.
Access control bypass in the HPE AOS-CX API endpoint allows a highly-privileged remote attacker to circumvent the device's configured access control policy and reach management functionality that should be restricted to a higher administrative tier. Affected devices include HPE switches running AOS-CX, as confirmed by HPE in advisory hpesbnw05134, which also covers four other AOS-CX CVEs in the same release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Authenticated path traversal in HPE AOS-CX's web-based management interface permits a low-privileged authenticated attacker to read arbitrary files from the underlying operating system, potentially exposing credentials, private keys, and device configuration data. The CVSS vector (AV:N/AC:L/PR:L) confirms the vulnerability is remotely exploitable with minimal complexity once valid credentials are obtained. This CVE is part of a broader HPE security advisory (hpesbnw05134) covering multiple AOS-CX vulnerabilities, including higher-severity unauthenticated RCE issues, making credential exposure via this flaw a plausible stepping-stone in a multi-stage attack chain. No public exploit identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in the HPE AOS-CX web-based management interface allows an authenticated attacker with low-privilege credentials to force the switch to issue arbitrary internal HTTP requests, exposing the internal network topology and enabling limited modification of sensitive information. The vulnerability carries a Scope:Changed CVSS designation because the forged requests cross the trust boundary from the management plane into internal infrastructure the attacker cannot otherwise reach. This is the fifth CVE bundled in HPE advisory hpesbnw05134en_us alongside more severe issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string RCE (CVE-2026-73782, CVSS 8.8). No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Denial of service in HPE Integrated Lights-Out 6 (iLO 6) firmware prior to v1.78 allows an unauthenticated attacker on an adjacent network segment to render the management interface unavailable. The impact is limited to availability (A:H) with no confidentiality or integrity compromise, but disrupting iLO can blind administrators to server state and block out-of-band recovery operations during incidents. No public exploit or active exploitation has been identified at time of analysis; HPE has released v1.78 as the fix.
Sensitive cryptographic material on HPE Networking Instant On 1830, 1930, and 1960 switches is exposed to remote network actors through an information disclosure vulnerability. Exploitation allows retrieval of cryptographic secrets such as private keys, certificates, or pre-shared credentials, which could subsequently enable man-in-the-middle attacks, traffic decryption, or device impersonation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Session persistence in HPE Aruba Networking Wireless Operating System (AOS-8) allows an attacker who has obtained valid user credentials to retain network access even after an administrator has disabled the associated account. The flaw affects AOS versions across the 8.10, 8.12, and 8.13 branches and stems from the platform's failure to invalidate active sessions upon credential revocation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.03% at the 10th percentile, placing this squarely in the low-real-world-risk tier despite its medium CVSS score.
Sensitive OS file disclosure in the HPE Aruba Networking AOS-10 Gateway web management interface allows authenticated remote administrators to read arbitrary files on the underlying operating system. Affected version ranges span AOS 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, and 10.8.0.0. No public exploit code exists and EPSS sits at 0.03% (11th percentile), with SSVC confirming no observed exploitation - risk is primarily from compromised admin credentials or insider threats rather than opportunistic attack.
XML entity expansion (CWE-776) in the DHCP XML handling component of HPE Aruba AOS Instant 8.x.x.x enables an unauthenticated remote attacker to cause denial-of-service via excessive resource consumption on affected Access Points. Exploitation requires both high attack complexity and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), restricting the realistic attack surface to scenarios where a connected wireless client triggers the vulnerable DHCP parsing path. No active exploitation has been identified - EPSS stands at 0.07% (21st percentile), SSVC confirms exploitation status of none, and the vulnerability is absent from CISA KEV.