Critical severity · published Oct 6, 2026
CVE-2026-76743
Authentication Bypass Vulnerability in the Management Interface of AOS-S
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AOS-Switch (AOS-S) · Hewlett Packard Enterprise (HPE)
16.11.0000 through 16.11.0031 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76743
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76743
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US
More from AOS-Switch (AOS-S)
9.8
CVE-2026-76744
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S
9.8
CVE-2026-76742
Authentication Bypass in the Web Management Interface of AOS-S
9.6
CVE-2026-76745
Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S
9.3
CVE-2026-76746
Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S
9.1
CVE-2026-76747
Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S
