Vulnerabilidades de Hewlett Packard Enterprise (HPE)

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Hewlett Packard Enterprise (HPE): 374 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-73762 Média · 6.6 CWE-284 01/09/2026

Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.

CVE-2026-73761 Média · 6.5 CWE-125 01/09/2026

Unauthenticated Out-of-Bounds Read Vulnerability leads to Information Disclosure in AOS-CX

An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a specially crafted packet. Successful exploitation of this vulnerability results in the ability to disclose sensitive information from the underlying operating system.

CVE-2026-73760 Média · 6.5 CWE-22 01/09/2026

Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files.

CVE-2026-73759 Média · 6.5 CWE-400 01/09/2026

Unauthenticated Denial-of-Service Vulnerabilities in AOS-CX

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploitation of these vulnerabilities results in disruption of normal operation on affected devices.

CVE-2026-73758 Média · 6.5 CWE-269 01/09/2026

Authenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.

CVE-2026-73757 Média · 6.4 CWE-918 01/09/2026

Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

CVE-2026-73756 Média · 5.9 CWE-319 01/09/2026

Unauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitation allows an attacker to retrieve data which could be used to further compromise the confidentiality of the affected system.

CVE-2026-73755 Média · 5.7 CWE-269 01/09/2026

Privilege Escalation via Unauthorized Access to Sensitive Session Information

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system.

CVE-2026-73754 Média · 5.3 CWE-400 01/09/2026

Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system.

CVE-2026-73753 Alta · 8.8 CWE-78 01/09/2026

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2026-73752 Alta · 8.8 CWE-22 01/09/2026

Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

CVE-2026-73751 Alta · 8.8 CWE-77 01/09/2026

Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system.

CVE-2026-73750 Alta · 8.8 CWE-284 01/09/2026

Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.

CVE-2026-73749 Crítica · 9.8 CWE-284 01/09/2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

CVE-2026-76658 Crítica · 10.0 CWE-287 01/09/2026

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVE-2026-76657 Crítica · 10.0 CWE-287 01/09/2026

Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

CVE-2026-73748 Baixa · 2.2 CWE-312 01/09/2026

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.

CVE-2026-73747 Baixa · 2.5 CWE-269 01/09/2026

Local Privilege Escalation Vulnerability in HPE Networking Fabric Composer

A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system.

CVE-2026-73746 Baixa · 3.1 CWE-400 01/09/2026

Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer API

A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.

CVE-2026-73745 Baixa · 3.1 CWE-200 01/09/2026

Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer

A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access when combined with other vulnerabilities.

CVE-2026-73744 Baixa · 3.5 CWE-400 01/09/2026

Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

CVE-2026-73743 Baixa · 3.7 CWE-319 01/09/2026

Unauthenticated Information Disclosure Leading to Data Exposure in HPE Networking Fabric Composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. A successful exploit could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.

CVE-2026-73742 Média · 4.3 CWE-290 01/09/2026

Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the affected system.

CVE-2026-73741 Média · 4.3 CWE-284 01/09/2026

Authenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API

A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level.

CVE-2026-73740 Média · 4.4 CWE-269 01/09/2026

Local Privilege Escalation in HPE Networking Fabric Composer

A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the affected system.