CVE-2026-76657 is a maximum-severity vulnerability (CVSS 3.1 base score 10.0) in the API of HPE Aruba Networking Fabric Composer, caused by improper authentication (CWE-287). The flaw allows an unauthenticated remote attacker to circumvent existing authentication controls on the AFC API and gain administrative access to the underlying host, with no privileges and no user interaction required.

CVE-2026-76657 was disclosed on 1 September 2026 in the same HPE security bulletin as CVE-2026-76658, an SSH daemon authentication bypass in the same product that CERTVU addressed in Advisory 226. The two are companion, separately exploitable flaws in different AFC interfaces (API versus SSH daemon) rather than the same bug. As with the SSH-daemon flaw, an attacker who obtains administrative access to the AFC host can execute arbitrary operating-system commands as a privileged user, resulting in complete compromise of the management platform and placing every network fabric it administers at risk. Patching is critical.

• HPE Aruba Networking Fabric Composer 7.0.0 – Affected

See HPE Security Bulletin HPESBNW05133 for the fixed release and update package – Not affected, patched.

CERTVU advises verifying HPE's public bulletin (docId HPESBNW05133) as the authoritative source for the specific fixed version and download package, which covers both CVE-2026-76657 and CVE-2026-76658 together.

Typical attack flow:

• Step 1 - Reach the AFC API An attacker identifies an HPE Aruba Networking Fabric Composer host with its API reachable over the network.
• Step 2 - Bypass Authentication and Gain Administrative Access The attacker sends crafted requests to the AFC API that circumvent existing authentication controls, obtaining administrative access without valid credentials, then executes arbitrary operating-system commands as a privileged user on the AFC host.

Attack vectors:

• Direct network access to the API service on an affected AFC host — no authentication, prior access, or user interaction is required.
• Particular risk where the AFC API or management interface is reachable from outside a trusted management network or the internet.

Successful exploitation may allow attackers to:

• Circumvent authentication on the AFC API and gain full administrative access to the AFC host.
• Achieve complete compromise of the network fabric management platform, with downstream risk to every switch fabric that AFC instance administers.

CERTVU recommends the following:

1. Apply the HPE Fix Without Delay
   • Consult HPE Security Bulletin HPESBNW05133 for the specific fixed release and apply it to every affected Fabric Composer 7.0.0 instance as a priority, given the maximum CVSS score and lack of any exploitation precondition. If your organization has already patched for CVE-2026-76658 (Advisory 226), confirm that same update also resolves CVE-2026-76657 rather than assuming it.
2. Restrict network exposure of the AFC API and management interface.
3. Restrict administrative access pending patching.
4. Audit the estate for the affected product.
5. Conduct a compromise assessment.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.