Vulnerabilities · 22h ago

HPE switch advisory flags management-plane bypasses

NCSC-NL said HPE has fixed multiple high-severity flaws in HPE Networking AOS-Switch (AOS-S), including two 9.8-rated authentication-bypass bugs in the management interface and several unauthenticated buffer-overflow and API issues. The advisory covers CVE-2026-76741 through CVE-2026-76749.

The management interface bugs let a remote attacker reach switch administration without valid credentials; the adjacent-network flaws can also let a nearby machine overflow memory, leak information, or trigger denial of service. In other words, this is not just packet-forwarding risk: the control plane itself is exposed, and one class of bug does not even require a password.

For teams that expose AOS-S management or API access on routed or flat internal networks, the durable exposure is the switch admin layer, not the individual forwarding path. If that layer sits where operators assume 'internal-only' means safe, a compromise can move straight into configuration and policy control.

CVEs in this update

9 CVEs

Across ArubaOS, AOS-Switch (AOS-S).

6 critical · 1 high · 2 medium · 0 low

0 in CISA KEV · 0 with EPSS above 1%

Highest severity: CVE-2026-76742 · 9.8 CRITICAL

Timeline

Sources

2 sources covering this story

Entities

Part of the PlainSec briefing for 2026-10-13

Editions

Related stories