CVE-2026-73778: Credential Manager Auth Bypass Vulnerability

CVE-2026-73778 Overview

CVE-2026-73778 is a weak password vulnerability [CWE-521] in the Credential Manager component of HPE networking devices. The flaw affects devices in factory-default or post-Zero Touch Provisioning (ZTP) state before an administrator configures credentials. An unauthenticated remote attacker can authenticate using a predictable factory-default password during the initial setup window. Successful exploitation grants full administrative control of the device.

Critical Impact
Attackers who reach a device during its initial provisioning window can gain complete administrative control by supplying a predictable factory-default password, compromising confidentiality, integrity, and availability.

Affected Products

HPE networking devices with the Credential Manager component (see HPE advisory)
Devices in factory-default state prior to administrator credential configuration
Devices in post-ZTP (Zero Touch Provisioning) state before credential enrollment

Discovery Timeline

2026-09-01 - CVE-2026-73778 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73778

Vulnerability Analysis

The vulnerability resides in the Credential Manager component responsible for handling authentication on newly provisioned devices. Affected devices ship with a predictable factory-default password that remains active until an administrator sets new credentials. During this window, any network-reachable attacker can authenticate as an administrator without prior knowledge of unique per-device secrets.

The issue maps to CWE-521: Weak Password Requirements. The predictable default credential removes the authentication barrier that Credential Manager is expected to enforce. The exploitation window opens at first boot or after a ZTP-initiated reset and closes only when an administrator enrolls a strong credential.

Root Cause

The root cause is the use of a static, predictable factory-default password in the Credential Manager component. The device does not require credential rotation or forced enrollment before exposing administrative interfaces to the network. Attackers who can reach the management interface before administrator configuration inherit administrative access.

Attack Vector

Exploitation requires network access to the affected device during its unconfigured state. The attacker authenticates against the administrative interface using the known factory-default password. High attack complexity reflects the timing constraint: the attacker must reach the device before an administrator completes initial credential setup. No user interaction or prior privileges are required.

No public proof-of-concept exploit code is available. See the HPE Security Bulletin for vendor-specific technical details.

Detection Methods for CVE-2026-73778

Indicators of Compromise

Successful administrative logins on newly provisioned devices from unexpected source addresses
Configuration changes on devices that have not completed formal administrator onboarding
Authentication events using default account names during the ZTP or first-boot window
Unexpected outbound connections from a device shortly after initial power-on

Detection Strategies

Correlate device provisioning events with the first successful administrative authentication and flag mismatches
Alert on any administrative login originating from outside approved provisioning networks or jump hosts
Monitor syslog for Credential Manager authentication events referencing default accounts
Compare running configuration hashes against expected post-provisioning baselines to detect unauthorized modifications

Monitoring Recommendations

Forward device authentication and configuration logs to a centralized SIEM for real-time correlation
Track time-to-first-credential-change as an operational metric across the fleet
Enable alerting on any device that remains in factory-default state longer than the approved provisioning window
Audit ZTP workflows to confirm credential enrollment occurs before management interfaces become network-reachable

How to Mitigate CVE-2026-73778

Immediate Actions Required

Apply the vendor patch referenced in the HPE Security Bulletin to all affected devices
Change factory-default credentials on every device before exposing management interfaces to production networks
Restrict management-plane network access to trusted provisioning subnets and jump hosts
Audit the fleet for devices still in factory-default or post-ZTP state and complete credential enrollment immediately

Patch Information

HPE has published guidance in the HPE Security Bulletin (hpesbnw05134en_us). Consult the bulletin for fixed firmware versions and product-specific remediation steps. Apply the vendor-supplied firmware update to all affected models.

Workarounds

Provision devices on an isolated out-of-band management network until administrator credentials are configured
Enforce forced password change on first login through provisioning automation and configuration templates
Disable or firewall management protocols on devices that have not completed credential enrollment
Use ZTP configurations that enroll strong credentials before enabling remote administrative access

bash

# Configuration example
# Refer to the HPE Security Bulletin for product-specific commands.
# General hardening pattern for newly provisioned devices:
# 1. Connect device via console or isolated management VLAN
# 2. Set a strong administrator password before enabling network management
# 3. Disable factory-default accounts where supported
# 4. Restrict management access via ACL to trusted subnets