A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain… (CVE-2026-76658)

CVE-2026-76658 is a critical vulnerability in the SSH daemon of HPE Networking Fabric Composer. It enables an unauthenticated remote attacker to gain administrative access to affected hosts. Successful exploitation allows arbitrary command execution as a privileged user on the underlying operating system, resulting in complete system compromise. The vulnerability is classified under CWE-287 (Improper Authentication). The CVSS v3.1 base score is 10.0, reflecting its critical impact with network attack vector, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact.

An attacker exploiting this vulnerability can remotely execute arbitrary commands with administrative privileges on the affected system without authentication. This leads to full system compromise, including potential data loss, service disruption, and unauthorized control over the device.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected SSH service and monitor for suspicious activity.