Hewlett Packard Enterprise (HPE) vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hewlett Packard Enterprise (HPE) products: 374 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-73714 High · 7.6 CWE-269 Sep 1, 2026

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further unauthorized access.

CVE-2026-73713 High · 7.8 CWE-269 Sep 1, 2026

Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer

Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow a local attacker to achieve arbitrary code execution with root privileges on the underlying operating system of the affected system.

CVE-2026-73712 High · 8.1 CWE-78 Sep 1, 2026

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer API

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVE-2026-73711 High · 8.1 CWE-269 Sep 1, 2026

Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API

A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

CVE-2026-73710 High · 8.2 CWE-306 Sep 1, 2026

Unauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer

Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the availability of the affected system, requiring manual intervention to restore functionality.

CVE-2026-73709 High · 8.3 CWE-78 Sep 1, 2026

Unauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-73708 High · 8.3 CWE-863 Sep 1, 2026

Fault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable system.

CVE-2026-73707 High · 8.5 CWE-863 Sep 1, 2026

Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, including changes to the configuration of systems managed by the affected product.

CVE-2026-73706 High · 8.6 CWE-306 Sep 1, 2026

Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal services and workflows and to make unauthorized changes that may disrupt the normal operation of the affected service.

CVE-2026-73705 High · 8.8 CWE-552 Sep 1, 2026

Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer

An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary commands on the underlying operating system, leading to complete compromise of the affected system.

CVE-2026-73704 High · 8.8 CWE-77 Sep 1, 2026

Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.

CVE-2026-73703 High · 8.8 CWE-79 Sep 1, 2026

Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVE-2026-73702 High · 8.8 CWE-863 Sep 1, 2026

Authenticated Privilege Escalation Vulnerability in the API of HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.

CVE-2026-73701 Critical · 9.0 CWE-94 Sep 1, 2026

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.

CVE-2026-73700 Critical · 9.0 CWE-79 Sep 1, 2026

Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVE-2026-19766 Critical · 9.6 CWE-287 Sep 1, 2026

Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.

CVE-2026-63457 Medium · 6.5 CWE-400 Aug 5, 2026

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior...

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.

CVE-2026-63456 Critical · 9.8 CWE-287 Aug 4, 2026

Authentication bypass via spoofed HTTP headers Orchestrator REST API

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

CVE-2026-63455 Critical · 9.8 CWE-306 Aug 4, 2026

Authentication bypass via spoofed HTTP headers Orchestrator REST API

CVE-2026-44879 High · 7.2 CWE-77 Jul 21, 2026

Authenticated Command Injection allows arbitrary command execution in CLI Interface

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-44878 High · 7.2 CWE-377 Jul 21, 2026

Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.

CVE-2026-63454 High · 7.2 CWE-22 Jul 21, 2026

Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution.

CVE-2026-63453 High · 7.2 CWE-120 Jul 21, 2026

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-44880 High · 8.8 CWE-120 Jul 21, 2026

Low-Privilege Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-44877 Medium · 6.5 CWE-200 Jul 7, 2026

Unauthenticated Remote Disclosure of Cryptographic Secrets

An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of this vulnerability could allow an unauthenticated remote threat actor to access sensitive cryptographic secrets on a vulnerable system.