{"id":"CVE-2026-23592","state":"PUBLISHED","title":"Insecure File Handling allows Remote Code Execution in Backup Functionality","description":"Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","publishedAt":"2026-01-27T17:57:57.364Z","updatedAt":"2026-02-27T14:33:27.535Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"hpe"},"assigner":"hpe","products":["Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabric Composer"],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"HPE Aruba Networking Fabric Composer","defaultStatus":"affected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"}]}],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04996en_us&docLocale=en_US"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23592.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23592","state":"PUBLISHED","datePublished":"2026-01-27T17:57:57.364Z","dateUpdated":"2026-02-27T14:33:27.535Z","assignerShortName":"hpe","assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateReserved":"2026-01-14T15:40:17.990Z"},"containers":{"cna":{"title":"Insecure File Handling allows Remote Code Execution in Backup Functionality","descriptions":[{"lang":"en","value":"Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system."}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"HPE Aruba Networking Fabric Composer","defaultStatus":"affected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04996en_us&docLocale=en_US"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"hpe","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateUpdated":"2026-01-27T17:58:58.029Z"},"credits":[{"lang":"en","type":"reporter","value":"Daniel Jensen (@dozernz)"}],"source":{"advisory":"HPESBNW04996","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-27T18:41:51.538808Z","id":"CVE-2026-23592","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","type":"CWE","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-27T14:33:27.535Z"}}]}}}