CVE-2026-19766CWE-287

CVE-2026-19766

Critical · published September 2, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer≥ 7.0.0, ≤ 7.3.3—
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:30Z
    Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer
    cvelistv5