NCSC-NL said HPE has fixed multiple high-severity flaws in HPE Networking AOS-Switch (AOS-S), including two 9.8-rated authentication-bypass bugs in the management interface and several unauthenticated buffer-overflow and API issues. The advisory covers CVE-2026-76741 through CVE-2026-76749.
The management interface bugs let a remote attacker reach switch administration without valid credentials; the adjacent-network flaws can also let a nearby machine overflow memory, leak information, or trigger denial of service. In other words, this is not just packet-forwarding risk: the control plane itself is exposed, and one class of bug does not even require a password.
For teams that expose AOS-S management or API access on routed or flat internal networks, the durable exposure is the switch admin layer, not the individual forwarding path. If that layer sits where operators assume 'internal-only' means safe, a compromise can move straight into configuration and policy control.