Vendor
H3C vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 24 vulnerabilities in H3C: 1 in the last 7 days and 6 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126759, was published on 12 November 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1). 2 critical against 1. 2 technologies have a page of their own.
- Last 7 days
- 1
- Last 90 days
- 6
- Critical, all time
- 5
- Exploited in the wild
- 0
About H3C
H3C is a provider of digitalization solutions, including networking, computing, storage, and security infrastructure.
H3C technologies
Latest H3C vulnerabilities
- CVE-2026-126759: H3C ICG2000 authentication bypass in Web Management ModulemediumCVSS 5.3
- CVE-2026-112373: H3C Magic NX15 stack-based buffer overflow in usrlistmediumCVSS 6.5
- CVE-2026-112372: H3C Magic NX15 path traversal in importprofilemediumCVSS 6.6
- CVE-2026-112371: H3C Magic NX15 code injection in /api/esps RPC interfacecriticalCVSS 9.9
- CVE-2026-112370: H3C Magic NX15 os command injection in usrlistcriticalCVSS 9.9
- CVE-2023-54405: H3C CVM unauthenticated arbitrary file uploadcriticalCVSS 9.8EPSS 0.6%
- CVE-2026-18902: H3C NX15 command injection in WAN repeater configurationhighCVSS 7.2EPSS 3.8%
- CVE-2026-18901: H3C NX15 dangerous routine exposure in Web APIhighCVSS 7.2EPSS 0.9%
- CVE-2026-18900: H3C NX15 OS command injection in Backend RPChighCVSS 7.2EPSS 3.8%
- CVE-2026-18814: H3C NX15 command injection in reload.reload_confighighCVSS 7.2EPSS 3.6%
- CVE-2026-18813: H3C NX15 command injection in /api/esps deletehighCVSS 7.2EPSS 3.6%
- CVE-2026-18812: H3C NX15 command injection in esps.ipv6.wanhighCVSS 7.2EPSS 3.6%
- CVE-2026-18811: H3C NX15 command injection in /api/esps Add functionhighCVSS 7.2EPSS 3.6%
- CVE-2026-18810: H3C NX15 authentication bypass in network setup APIhighCVSS 7.3EPSS 0.7%
- CVE-2025-29296: H3C Magic and NX series command injection in APIcriticalCVSS 9.8EPSS 2.3%
- CVE-2026-15907: H3C SecPath F1000-C8300 SQL injection in log_fw_nbc_mail_jsondatahighCVSS 7.3
- CVE-2026-15479: H3C NX15 weak password recovery in Administrator Password Modification EndpointhighCVSS 7.3
- CVE-2026-10259: H3C Magic B0 stack overflow in SetMobileAPInfoByIdhighCVSS 8.8
- CVE-2026-9393: H3C Magic B0 buffer overflow in Edit_BasicSSID_5GhighCVSS 8.8EPSS 0.0%
- CVE-2026-8764: H3C Magic B3 buffer overflow in UpdateWanParamshighCVSS 7.2
- CVE-2025-60262: An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a…criticalCVSS 9.8EPSS 0.6%
- CVE-2025-14015: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file…highCVSS 8.8EPSS 0.8%
- CVE-2025-63258: H3C Multiple Routers and Gateways Command Injection in sessionidmediumCVSS 6.5EPSS 0.3%
- CVE-2025-44653: H3C GR2200 resource exhaustion in bftpd configurationhighCVSS 7.5EPSS 0.5%
Most severe H3C vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-112371: H3C Magic NX15 code injection in /api/esps RPC interfacecriticalCVSS 9.9
- CVE-2026-112370: H3C Magic NX15 os command injection in usrlistcriticalCVSS 9.9
- CVE-2025-29296: H3C Magic and NX series command injection in APIcriticalCVSS 9.8EPSS 2.3%
- CVE-2023-54405: H3C CVM unauthenticated arbitrary file uploadcriticalCVSS 9.8EPSS 0.6%
- CVE-2025-60262: An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a…criticalCVSS 9.8EPSS 0.6%
- CVE-2025-14015: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file…highCVSS 8.8EPSS 0.8%
- CVE-2026-9393: H3C Magic B0 buffer overflow in Edit_BasicSSID_5GhighCVSS 8.8EPSS 0.0%
- CVE-2026-10259: H3C Magic B0 stack overflow in SetMobileAPInfoByIdhighCVSS 8.8
- CVE-2025-44653: H3C GR2200 resource exhaustion in bftpd configurationhighCVSS 7.5EPSS 0.5%
- CVE-2026-18810: H3C NX15 authentication bypass in network setup APIhighCVSS 7.3EPSS 0.7%
Vulnerabilities per week
4 vulnerabilities in the last four weeks, up 300% on the four before (1). 2 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 1 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 4 | 2 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many H3C vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/h3c)<a href="https://junglewise.ai/threats/vendors/h3c"><img src="https://junglewise.ai/threats/vendors/h3c/badge.svg" alt="H3C vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/h3c.json, and this page as text at https://junglewise.ai/threats/vendors/h3c.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "H3C vulnerabilities", https://junglewise.ai/threats/vendors/h3c, 12 November 2026.