Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged User

HPE released security updates for Fabric Composer addressing 52 vulnerabilities — notably two unauthenticated, network-exploitable critical flaws (CVE-2026-76657 and CVE-2026-76658, both CVSS 10.0) that can grant administrative access or enable privileged remote code execution; multiple additional critical and high-severity issues (authentication bypasses, RCE, XSS, privilege escalation, SQL injection, arbitrary file write) were listed. Administrators are urged to upgrade affected 7.3.x/7.4.x installations, isolate management interfaces, restrict access with firewall policies, review logs for suspicious SSH/API/admin activity, and rotate credentials where compromise is suspected.