HPE Aruba Patches Fabric Composer, VIA Flaws
HPE Aruba Networking fixed dozens of vulnerabilities in Fabric Composer and Virtual Intranet Access that enable remote code execution, privilege escalation and denial of service.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has relayed two HPE Aruba Networking security bulletins (HPESBNW05172 and HPESBNW05173, published 3 November 2026) covering a large batch of vulnerabilities affecting Fabric Composer (versions 7.4.x prior to 7.4.1, and versions prior to 7.3.5) and Virtual Intranet Access (VIA) versions prior to 4.7.9. The advisory lists over 50 CVEs collectively allowing attackers to achieve remote code execution, privilege escalation, remote denial of service, SQL injection, security policy bypass, and compromise of data confidentiality and integrity.
No evidence of in-the-wild exploitation is mentioned in the advisory. CERT-FR's guidance is to apply the vendor's patches as referenced in the official HPE Aruba security bulletins. Given the volume and severity range of issues (including RCE and privilege escalation) affecting network management and remote access infrastructure, organizations running the affected Fabric Composer or VIA versions should prioritize patching promptly, particularly where these components are internet-facing or manage critical network fabric.
Defenders should inventory deployments of HPE Aruba Fabric Composer and VIA, confirm software versions against the fixed releases (Fabric Composer 7.4.1+/7.3.5+, VIA 4.7.9+), and apply vendor patches without delay. Monitoring for anomalous administrative activity, unexpected privilege changes, or unusual SQL query patterns on affected management systems is advised pending patch deployment.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1451
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs