HPE Aruba Patches High-Severity RCE and OpenSSL Flaws

HPE Aruba Networking has released a critical security advisory urging administrators to patch their Fabric Composer software immediately. The update addresses a trio of vulnerabilities, including a dangerous Remote Code Execution (RCE) flaw that could allow attackers to seize control of the underlying operating system.

The advisory highlights the risks facing the HPE Aruba Networking Fabric Composer, a software-defined orchestration tool used to simplify network provisioning.

The most alarming vulnerability in the batch is tracked as CVE-2026-23592. It strikes at the heart of the system’s backup functionality. Due to insecure file operations, an authenticated attacker could exploit this feature to execute arbitrary commands.

As the advisory states: “Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution.”

While this vulnerability requires authentication, the potential impact is catastrophic. “Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system,” effectively giving them the keys to the kingdom.

The update also patches a high-severity flaw inherited from the OpenSSL library, tracked as CVE-2024-4741. This “Use After Free” vulnerability involves the SSL_free_buffers function.

The report notes that while this function is rarely used, the risk remains real. “A call to SSL_free_buffers will succeed even though the buffer is still in use,” the advisory explains. “While these scenarios could occur accidentally during normal operation, a malicious attacker could attempt to engineer a situation where this occurs”.

The third flaw is a medium-severity information disclosure flaw (CVE-2026-23593). Discovered by security researcher Daniel Jensen, this vulnerability affects the web-based management interface.

“A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files,” the report warns. “Successful exploitation could allow an attacker to read files within the affected directory”.

HPE Aruba Networking has released version 7.3.0 to squash these bugs. The advisory is clear on the solution: “Upgrade the HPE Aruba Networking Fabric Composer to the following version to resolve the vulnerabilities described in the details section: HPE Aruba Networking Fabric Composer 7.x.x: 7.3.0 and above”.

For those unable to patch immediately, the company recommends strict network segmentation. “HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above”.

Related Posts:

• “ConfusedComposer”: GCP Composer Vulnerability Allows Privilege Escalation
• CVE-2024-48510 (CVSS 9.8): Critical Flaw in ABB Drive Composer Enables File System Access
• Cisco Patches Multiple Critical Security Vulnerabilities
• CVSS 9.8 Vulnerabilities Expose Aruba Access Points to RCE: HPE Urges Immediate Action