AOS-CX, Fabric Composer: control outbound requests

Published · Updated · APIs and connected services · 5 min read · By Cyber Intelligence Embassy

At a glance

AOS-CX, Fabric Composer: server-side request forgery (SSRF). This 2026-09-02 case examines 6 version entries and 86 CVEs, documented releases and checks suited to network access, using CERTFR-2026-AVI-1104.

AI illustration: a dark cybersecurity technology space with restrained golden lighting Illustration · fictional scene
In this article

Retrospective for 2026-09-02, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.

What this advisory changes in your environment

The starting point is CERTFR-2026-AVI-1104, published on 2026-09-02. Its scope includes AOS-CX, Fabric Composer. Reported consequences are denial of service, cross-site scripting (XSS), cross-site request forgery (CSRF), remote code execution, data integrity compromise, SQL injection, server-side request forgery (SSRF), security control bypass, loss of confidentiality, privilege escalation. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.

This case contains 6 version entries; CVE identifier count: 86. Track remediation by component: a successful overall update does not demonstrate that AOS-CX and Fabric Composer each received their respective fix.

Products and versions to examine

Reference
CERTFR-2026-AVI-1104
Source first published
2026-09-02
Latest source revision available for this day
2026-09-02
Named components
AOS-CX, Fabric Composer
CVE identifiers
CVE-2026-73733, CVE-2026-73709, CVE-2026-73736, CVE-2026-73759, CVE-2026-73710, CVE-2026-73780, CVE-2026-73723, CVE-2026-73711, CVE-2026-73722, CVE-2026-73764, CVE-2026-73778, CVE-2026-73738, CVE-2026-73773, CVE-2026-73753, CVE-2026-76658, CVE-2026-73716, CVE-2026-73742, CVE-2026-73743, CVE-2026-73725, CVE-2026-73735, CVE-2026-73766, CVE-2026-73731, CVE-2026-73781, CVE-2026-73707 … (+62)
ComponentPublished condition
AOS-CX10.13.x : < 10.13.1190
Fabric Composer< 7.3.4
AOS-CX10.18.x : < 10.18.1002
AOS-CX10.16.x : < 10.16.1060
AOS-CX10.17.x : < 10.17.1030
AOS-CX< 10.10.1181

For AOS-CX, the published condition is “10.13.x : < 10.13.1190”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of AOS-CX, Fabric Composer does not close this case.

Mechanism and prerequisites

SSRF abuses requests a server is allowed to make. Inspect outbound destinations, metadata access and service secrets; segmentation can reduce impact without repairing the vulnerable request logic.

The primary record CVE-2026-73733, published by hpe, covers Fabric Composer. The retained revision is dated 2026-09-01. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-1104.

The published metric for CVE-2026-73733 is CVSS 3.1, 5.4/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack vector
network
Prior privileges
low
User interaction
none
Complexity
low

Choose the appropriate intervention

  1. Locate AOS-CX instances, running releases and service owners. Record condition 10.13.x : < 10.13.1190 in the ticket alongside reference CERTFR-2026-AVI-1104.
  2. Compare the installed branch with the vendor’s AOS-CX release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
  3. After changing AOS-CX, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.

Verify the fix in a real workflow

Validation scenario to adapt for AOS-CX, Fabric Composer: For AOS-CX, test an authorised business flow from each zone reaching the service and confirm management restrictions. If a redundant pair exists, verify both nodes and rule persistence after failover during a planned maintenance window. This is a proposed defensive check, not a claim that testing was performed against third-party systems.

Limit of case CERTFR-2026-AVI-1104: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.

Questions specific to this case

Which condition should be checked for AOS-CX?

Advisory CERTFR-2026-AVI-1104 states: AOS-CX — 10.13.x : < 10.13.1190. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.

Why not use one fix for AOS-CX and Fabric Composer?

CERTFR-2026-AVI-1104 distinguishes these components within a scope containing 6 entries. Match each branch to its own update documentation and functional check.

Which prerequisites does record CVE-2026-73733 specify?

For CVE-2026-73733, the published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Verify those conditions on Fabric Composer before applying them to an integration named in CERTFR-2026-AVI-1104.

Sources and related reading

Practical guide : Software inventory: prepare for end of support

Explore the decision addressed in this case

Complete source advisory inventory

The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.

Official source · CERTFR-2026-AVI-1104
Advisory revision : · Checked on :

Affected systems · 6

Original French wording is retained to avoid ambiguous translations of version conditions.

  1. AOS-CX versions 10.13.x antérieures à 10.13.1190
  2. Fabric Composer versions antérieures à 7.3.4
  3. AOS-CX versions 10.18.x antérieures à 10.18.1002
  4. AOS-CX versions 10.16.x antérieures à 10.16.1060
  5. AOS-CX versions 10.17.x antérieures à 10.17.1030
  6. AOS-CX versions antérieures à 10.10.1181

Historical note from this revision: check current patch availability with the vendor before acting.

Les versions 10.10.x d'AOS-CX ne sont plus maintenues et n'ont reçu les correctifs que pour les vulnérabilités critiques. Il est préférable de migrer vers une version maintenue.

CVE identifiers · 86