CVE-2026-19766 (CVSS 3.1 base score 9.6, Critical) is an authentication bypass vulnerability in the underlying operating system of HPE Aruba Networking Fabric Composer. Unlike the other flaws in this bulletin, this one requires the attacker to be on the adjacent network (CVSS attack vector "Adjacent" rather than "Network"), but otherwise requires no privileges and no user interaction, and has low attack complexity. Successful exploitation allows an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.

CVE-2026-19766 was disclosed on 1 September 2026 in the same HPE security bulletin (HPESBNW05133) as CVE-2026-76657, CVE-2026-76658, CVE-2026-73700, and CVE-2026-73701, four further critical vulnerabilities in the same product that CERTVU addressed in Advisory 230, Advisory 226, Advisory 231, and Advisory 232 respectively. This is a distinct, fifth vulnerability rather than a duplicate of any of those. Successful exploitation results in arbitrary code execution as a privileged user on the underlying operating system, leading to complete compromise of the AFC host, consistent with the other advisories in this bulletin, though this flaw specifically requires adjacent network access rather than being exploitable from anywhere on the network.

• HPE Aruba Networking Fabric Composer 7.0.0 – Affected

See HPE Security Bulletin HPESBNW05133 for the fixed release and update package – Not affected, patched.

CERTVU advises verifying HPE's public bulletin (docId HPESBNW05133) as the authoritative source for the specific fixed version and download package, which covers CVE-2026-19766 alongside CVE-2026-76657, CVE-2026-76658, CVE-2026-73700, and CVE-2026-73701.

Typical attack flow:

• Step 1 - Gain Adjacent Network Access to an Affected AFC Host An attacker positions themselves on the same local or adjacent network segment as an HPE Aruba Networking Fabric Composer host, for example by compromising another device on that segment or gaining access to the management network.
• Step 2 - Bypass Authentication and Execute Code as a Privileged User The attacker exploits the authentication bypass in the underlying operating system to execute arbitrary code as a privileged user, with no valid credentials, prior access, or user interaction required beyond adjacent network positioning.

Attack vectors:

• Adjacent network access to an affected AFC host — no authentication, prior access, or user interaction is required, but the attacker must be on the same local or adjacent network segment rather than able to reach the host from anywhere on the network.
• Particular risk in flat or poorly segmented network designs where an attacker who compromises any device on the same segment as the AFC host can reach it directly.

Successful exploitation may allow attackers to:

• Bypass authentication and execute arbitrary code as a privileged user on the underlying operating system of the AFC host.
• Achieve complete compromise of the network fabric management platform, with downstream risk to every switch fabric that AFC instance administers.

CERTVU recommends the following:

1. Apply the HPE Fix Without Delay
   • Consult HPE Security Bulletin HPESBNW05133 for the specific fixed release and apply it to every affected Fabric Composer 7.0.0 instance. If your organization has already patched for CVE-2026-76657, CVE-2026-76658, CVE-2026-73700, or CVE-2026-73701 (Advisories 230, 226, 231, and 232), confirm that same update also resolves CVE-2026-19766 rather than assuming it.
2. Segment networks to limit adjacent access to AFC hosts.
3. Treat AFC as a high-value target pending patching.
4. Audit the estate for the affected product.
5. Conduct a compromise assessment.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.