HPESBNW05156 rev 1 - Multiple Vulnerabilities in HPE Networking AOS-Swtich (AOS-S)

VULNERABILITY SUMMARY

Note: A signed text copy of this document exists at hpe_networking_-_hpesbnw05156.txt

Note: A CSAF version of this document exists at hpe_networking_-_hpesbnw05156.json

Summary

HPE Networking has released patches for the HPE Networking AOS-Switch (AOS-S) that address multiple security vulnerabilities.

Affected Products

These vulnerabilities affect the following HPE Networking AOS-Switch (AOS-S) software versions unless specifically noted otherwise in the details section:

HPE Networking AOS-Switch (AOS-S)

Unffected Products

Any other HPE Networking products and software versions Not specifically listed above are not affected by these vulnerabilities.

Workaround

To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.

Exploitation and Public Discussion

These vulnerabilities were generally discovered by internal security research at HPE Networking. HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory. Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.

Please note that due to the size of the Details and References sections, these sections have been moved to the end of the document to improve readability.

Details

Authentication Bypass in the Web Management Interface of AOS-S (CVE-2026-76742)

Authentication bypass vulnerabilities exist in the web management
interface of AOS-S. Successful exploitation could allow an
unauthenticated remote attacker to gain unauthorized access to
the affected system.

Internal References: VULN-1429, VULN-1453
Severity: Critical
CVSS v3.1 Base Score: 9.8
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Acknowledgements: Internal security research (HPE Networking).

Authentication Bypass Vulnerability in the Management Interface of AOS-S (CVE-2026-76743)

A vulnerability have been identified in the management interface
of AOS-S that could potentially allow an unauthenticated remote
attacker to circumvent existing authentication controls if
certain preconditions outside of the attacker's control are met.
Successful exploitation could allow an attacker to gain
unauthorized access to the affected system.

Internal References: VULN-1438
Severity: Critical
CVSS v3.1 Base Score: 9.8
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Acknowledgements: Internal security research (HPE Networking).

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S (CVE-2026-76744)

Buffer overflow vulnerabilities exist in the affected interface
of AOS-S. Successful exploitation could allow an unauthenticated
remote attacker to execute arbitrary code.

Internal References: VULN-594, VULN-595, VULN-596, VULN-597,
VULN-598, VULN-623, VULN-630, VULN-1421,
VULN-1422, VULN-1424, VULN-1425, VULN-1448,
VULN-1451, VULN-1427, VULN-1450, VULN-1419,
VULN-1426, VULN-1428, VULN-1437, VULN-1447
Severity: Critical
CVSS v3.1 Base Score: 9.8
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Acknowledgements: Internal security research (HPE Networking).

Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S (CVE-2026-76745)

Memory corruption vulnerabilities exist in AOS-S that are
reachable by an unauthenticated adjacent attacker. Successful
exploitation could allow an attacker to execute arbitrary code.

Internal References: VULN-1436, VULN-1446, VULN-1435, VULN-1445
Severity: Critical
CVSS v3.1 Base Score: 9.6
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Acknowledgements: Internal security research (HPE Networking).

Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S (CVE-2026-76746)

An unauthenticated buffer overflow vulnerability exists in AOS-S.
Successful exploitation could allow an unauthenticated adjacent
attacker to expose sensitive memory contents and cause a denial
of service on the affected device.

Internal References: VULN-1434
Severity: Critical
CVSS v3.1 Base Score: 9.3
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Acknowledgements: Internal security research (HPE Networking).

Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S (CVE-2026-76747)

Buffer overflow vulnerabilities exist in the affected interface
of AOS-S. Successful exploitation could allow an unauthenticated
remote attacker to expose sensitive memory contents and cause a
denial of service on the device.

Internal References: VULN-1432, VULN-1440, VULN-1442, VULN-1443,
VULN-1430, VULN-1431, VULN-1433, VULN-1439,
VULN-1441, VULN-1444, VULN-1420
Severity: Critical
CVSS v3.1 Base Score: 9.1
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Acknowledgements: Internal security research (HPE Networking).

Authenticated Privilege Escalation Vulnerability in the API of AOS-S (CVE-2026-76748)

A privilege escalation vulnerability exists in the API of AOS-S.
Successful exploitation could allow an authenticated read-only
user to escalate their privileges and gain administrative access
to the affected system.

Internal References: VULN-609
Severity: High
CVSS v3.1 Base Score: 8.8
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Acknowledgements: Internal security research (HPE Networking).

Authenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-S (CVE-2026-76741)

Buffer overflow vulnerabilities exist in the affected interface
of AOS-S. Successful exploitation could allow an authenticated
remote attacker to cause a denial-of-service condition on the
affected system.

Internal References: VULN-1423, VULN-1449
Severity: Medium
CVSS v3.1 Base Score: 6.5
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Acknowledgements: Internal security research (HPE Networking).

Unauthenticated Sensitive Information Disclosure in AOS-S (CVE-2026-76749)

A sensitive information disclosure vulnerability exists in AOS-S.
Successful exploitation could allow an unauthenticated remote
attacker to access sensitive information.

Internal References: VULN-1452
Severity: Medium
CVSS v3.1 Base Score: 6.5
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Acknowledgements: Internal security research (HPE Networking).