An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.

CVE-2026-19766 describes a critical authentication bypass vulnerability in the underlying operating system of HPE Networking Fabric Composer (AFC). An unauthenticated attacker with adjacent network access can exploit this flaw to execute arbitrary code as a privileged user on the underlying OS. Successful exploitation leads to complete compromise of the AFC host. No authentication is required, lowering the barrier for exploitation significantly. The vulnerability is classified as high severity given the potential for full system takeover. HPE has published a security bulletin with remediation guidance. The attack vector is adjacent network, meaning the attacker must be on the same network segment. This represents a significant risk for organizations using HPE networking management infrastructure.