CVE-2026-76658: critical vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.7%
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Hewlett Packard Enterprise (HPE) · Fabric ComposerRelated CVEs — Hewlett Packard Enterprise (HPE) Fabric Composer
In the same product, most dangerous first.
CVE-2026-73722HIGHAuthenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 1.5%CVE-2026-73720HIGHAuthenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer APIEPSS 1.1%CVE-2026-73717HIGHUnauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 0.8%CVE-2026-76657CRITICALAuthentication Bypass in HPE Networking Fabric Composer API allows Administrative AccessEPSS 0.7%CVE-2026-95756MEDIUMAuthenticated Command Injection Vulnerability in the API of HPE Networking Fabric ComposerEPSS 0.7%CVE-2026-73701CRITICALUnauthenticated Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.7%