Vulnerability

CERT-In Vulnerability Note CIVN-2026-0050
Multiple Vulnerabilities in HPE Aruba Products

Original Issue Date:January 28, 2026

Severity Rating: HIGH

Systems Affected

HPE Aruba Networking Fabric Composer

Overview

Multiple vulnerabilities have been reported in the HPE Aruba Networking Fabric Composer that could be exploited by an authenticated attacker to execute arbitrary commands on the targeted system.

Target Audience:
Network and Security Administrators,IT Operations and System Engineers,Enterprise Architects and CIOs/CTOs,Managed Service Providers (MSPs)

Risk Assessment:
There are high risks of Confidentiality, Operational, Integrity, and Availability

Impact Assessment:
There are high risks of Confidentiality, Integrity, and Availability.

Description

HPE Aruba Networking Fabric Composer is a centralized network management and automation platform designed to simplify the deployment, configuration, and operation of modern data center and campus networks.

1. Remote Code Execution Vulnerability ( CVE-2026-23592 )

A vulnerability exists due to insecure file operations in the backup functionality of HPE Aruba Networking Fabric Composer. This Vulnerability could allow an authenticated attacker to achieve remote code execution.
Successfully exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.

2. Information Disclosure Vulnerability ( CVE-2026-23593 )

A Vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer that could allow an unauthenticated remote attacker to view and access sensitive system files.
Successfully exploitation of this vulnerability could allow an attacker to read files within the affected directory.

Solution

Apply appropriate software updates as mentioned by Security vendor
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04996en_us&docLocale=en_US

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04996en_us&docLocale=en_US

CVE Name
CVE-2026-23592
CVE-2026-23593

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India