CVE-2026-76746 – HPE AOS-Switch (AOS-S)

HPE has patched six Critical vulnerabilities in AOS-Switch (AOS-S). The most serious flaws let an unauthenticated attacker bypass authentication on the management interface or run arbitrary code on the switch. CVE-2026-76742 has a CVSS score of 9.8, Critical severity, and CVE-2026-76743 has a CVSS score of 9.8, Critical severity. Both allow an attacker to bypass authentication and gain unauthorized access. CVE-2026-76744 has a CVSS score of 9.8, Critical severity. It is a buffer overflow that lets an unauthenticated remote attacker execute arbitrary code.

CVE-2026-76745 has a CVSS score of 9.6, Critical severity. It is a memory corruption flaw that lets an unauthenticated adjacent attacker execute arbitrary code. CVE-2026-76746 has a CVSS score of 9.3, Critical severity, and CVE-2026-76747 has a CVSS score of 9.1, Critical severity. These two buffer overflows expose sensitive memory and can cause a denial of service on the device. Switches sit at the core of the network, so a compromised device gives attackers a strong position for further attacks and can take down connectivity. Patch AOS-S switches today and restrict access to their management interfaces.