PT-2026-84438

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL...

PT-2026-84404

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to...

CVE-2026-73751: Improper Neutralization of Special Elements used in a Command

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

PT-2026-84497

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description The web-based management interface lacks Cross-Site Request Forgery CSRF protection for certain sessions. This allows a remote unauthenticated attacker to execute arbitrary input...

PT-2026-84478

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated Path Traversal vulnerability exists in the web-based management interface. Path Traversal is a flaw that allows an attacker to access files and directories that are stored...

CVE-2026-73760: Improper Limitation of a Pathname to a Restricted Directory

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files...

CVE-2026-73736: Files or Directories Accessible to External Parties

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory...

CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-73723: Incorrect Authorization

A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorizati...

CVE-2026-73734: URL Redirection to Untrusted Site

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

PT-2026-84447

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. A successful exploit could allow an attacker to gain access to some data in a cleartext format...

PT-2026-84435

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script...

CVE-2026-73771: Improper Authentication

An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote attacker could exploit this vulnerability under specific conditions to bypass authentication controls or exhaust system resources...

CVE-2026-73757: Server-Side Request Forgery (SSRF)

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery SSRF attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential...

CVE-2026-73780: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-73744: Uncontrolled Resource Consumption

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

CVE-2026-73717: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...

CVE-2026-73781: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's...

PT-2026-84440

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory...