CVE-2026-95740

Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95739

Unauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric Composer

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95735

Improper Certificate Validation in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95734

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95732

Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95731

Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-73755

Privilege Escalation via Unauthorized Access to Sensitive Session Information

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more

CVE-2026-76741

Authenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-S

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-service condition on the affected system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76742

Authentication Bypass in the Web Management Interface of AOS-S

Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76743

Authentication Bypass Vulnerability in the Management Interface of AOS-S

A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76744

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76745

Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S

Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76746

Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S

An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76747

Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76748

Authenticated Privilege Escalation Vulnerability in the API of AOS-S

A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76749

Unauthenticated Sensitive Information Disclosure in AOS-S

A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-79813

Local Privilege Escalation in ClearPass Client Software

A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attacker's control are met.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Clearpass Policy Manager (cppm)

CVE-2026-79814

Local Arbitrary File Write Leading to Local Privilege Escalation in ClearPass Policy Manager OnGuard Agent

An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute arbitrary code with elevated privileges on the affected system.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Clearpass Policy Manager (cppm)

CVE-2026-76754

Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager

A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Clearpass Policy Manager (cppm)

CVE-2026-79801

Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent

A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Clearpass Policy Manager (cppm)