# H3C vulnerabilities Source: https://junglewise.ai/threats/vendors/h3c Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/h3c.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in H3C: 1 in the last 7 days and 6 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126759, was published on 12 November 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1). 2 critical against 1. 2 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 5 - Last 90 days: 6 - All time: 24 (5 critical, 0 exploited in the wild) ## About H3C H3C is a provider of digitalization solutions, including networking, computing, storage, and security infrastructure. ## Latest H3C vulnerabilities - [CVE-2026-126759: H3C ICG2000 authentication bypass in Web Management Module](https://junglewise.ai/threats/cve-2026-126759-a-flaw-has-been-found-in-h3c-icg2000-unified-communication) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-112373: H3C Magic NX15 stack-based buffer overflow in usrlist](https://junglewise.ai/threats/cve-2026-112373-a-security-vulnerability-has-been-detected-in-h3c-magic-nx15) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-112372: H3C Magic NX15 path traversal in importprofile](https://junglewise.ai/threats/cve-2026-112372-a-weakness-has-been-identified-in-h3c-magic-nx15-v100r017-this) (medium, CVSS 6.6, published 19 Oct 2026) - [CVE-2026-112371: H3C Magic NX15 code injection in /api/esps RPC interface](https://junglewise.ai/threats/cve-2026-112371-a-vulnerability-was-determined-in-h3c-magic-nx15-nx15v100r017) (critical, CVSS 9.9, published 19 Oct 2026) - [CVE-2026-112370: H3C Magic NX15 os command injection in usrlist](https://junglewise.ai/threats/cve-2026-112370-a-vulnerability-was-found-in-h3c-magic-nx15-100r017-this-issue) (critical, CVSS 9.9, published 19 Oct 2026) - [CVE-2023-54405: H3C CVM unauthenticated arbitrary file upload](https://junglewise.ai/threats/cve-2023-54405-h3c-cvm-the-cloud-virtualization-management-component-of-the-h3c) (critical, CVSS 9.8, published 2 Oct 2026) - [CVE-2026-18902: H3C NX15 command injection in WAN repeater configuration](https://junglewise.ai/threats/cve-2026-18902-h3c-nx15-command-injection-in-wan-repeater-configuration) (high, CVSS 7.2, published 5 Aug 2026) - [CVE-2026-18901: H3C NX15 dangerous routine exposure in Web API](https://junglewise.ai/threats/cve-2026-18901-h3c-nx15-dangerous-routine-exposure-in-web-api) (high, CVSS 7.2, published 5 Aug 2026) - [CVE-2026-18900: H3C NX15 OS command injection in Backend RPC](https://junglewise.ai/threats/cve-2026-18900-h3c-nx15-os-command-injection-in-backend-rpc) (high, CVSS 7.2, published 5 Aug 2026) - [CVE-2026-18814: H3C NX15 command injection in reload.reload_config](https://junglewise.ai/threats/cve-2026-18814-h3c-nx15-command-injection-in-reload-reload-config) (high, CVSS 7.2, published 4 Aug 2026) - [CVE-2026-18813: H3C NX15 command injection in /api/esps delete](https://junglewise.ai/threats/cve-2026-18813-h3c-nx15-command-injection-in-api-esps-delete) (high, CVSS 7.2, published 4 Aug 2026) - [CVE-2026-18812: H3C NX15 command injection in esps.ipv6.wan](https://junglewise.ai/threats/cve-2026-18812-h3c-nx15-command-injection-in-esps-ipv6-wan) (high, CVSS 7.2, published 4 Aug 2026) - [CVE-2026-18811: H3C NX15 command injection in /api/esps Add function](https://junglewise.ai/threats/cve-2026-18811-h3c-nx15-command-injection-in-api-esps-add-function) (high, CVSS 7.2, published 4 Aug 2026) - [CVE-2026-18810: H3C NX15 authentication bypass in network setup API](https://junglewise.ai/threats/cve-2026-18810-h3c-nx15-authentication-bypass-in-network-setup-api) (high, CVSS 7.3, published 4 Aug 2026) - [CVE-2025-29296: H3C Magic and NX series command injection in API](https://junglewise.ai/threats/cve-2025-29296-h3c-magic-and-nx-series-command-injection-in-api) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-15907: H3C SecPath F1000-C8300 SQL injection in log_fw_nbc_mail_jsondata](https://junglewise.ai/threats/cve-2026-15907-h3c-secpath-f1000-c8300-sql-injection-in-log-fw-nbc-mail-jsondata) (high, CVSS 7.3, published 16 Jul 2026) - [CVE-2026-15479: H3C NX15 weak password recovery in Administrator Password Modification Endpoint](https://junglewise.ai/threats/cve-2026-15479-h3c-nx15-weak-password-recovery-in-administrator-password) (high, CVSS 7.3, published 12 Jul 2026) - [CVE-2026-10259: H3C Magic B0 stack overflow in SetMobileAPInfoById](https://junglewise.ai/threats/cve-2026-10259-h3c-magic-b0-stack-overflow-in-setmobileapinfobyid) (high, CVSS 8.8, published 1 Jun 2026) - [CVE-2026-9393: H3C Magic B0 buffer overflow in Edit_BasicSSID_5G](https://junglewise.ai/threats/cve-2026-9393-h3c-magic-b0-buffer-overflow-in-edit-basicssid-5g) (high, CVSS 8.8, published 24 May 2026) - [CVE-2026-8764: H3C Magic B3 buffer overflow in UpdateWanParams](https://junglewise.ai/threats/cve-2026-8764-h3c-magic-b3-buffer-overflow-in-updatewanparams) (high, CVSS 7.2, published 17 May 2026) - [CVE-2025-60262: An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a…](https://junglewise.ai/threats/cve-2025-60262-an-issue-in-h3c-m102g-hm1a0v200r010-wireless-controller-and) (critical, CVSS 9.8, published 6 Jan 2026) - [CVE-2025-14015: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file…](https://junglewise.ai/threats/cve-2025-14015-a-weakness-has-been-identified-in-h3c-magic-b0-up-to-100r002-this) (high, CVSS 8.8, published 4 Dec 2025) - [CVE-2025-63258: H3C Multiple Routers and Gateways Command Injection in sessionid](https://junglewise.ai/threats/cve-2025-63258-h3c-multiple-routers-and-gateways-command-injection-in-sessionid) (medium, CVSS 6.5, published 18 Nov 2025) - [CVE-2025-44653: H3C GR2200 resource exhaustion in bftpd configuration](https://junglewise.ai/threats/cve-2025-44653-h3c-gr2200-resource-exhaustion-in-bftpd-configuration) (high, CVSS 7.5, published 21 Jul 2025) ## Most severe H3C vulnerabilities - [CVE-2026-112371: H3C Magic NX15 code injection in /api/esps RPC interface](https://junglewise.ai/threats/cve-2026-112371-a-vulnerability-was-determined-in-h3c-magic-nx15-nx15v100r017) (critical, CVSS 9.9, published 19 Oct 2026) - [CVE-2026-112370: H3C Magic NX15 os command injection in usrlist](https://junglewise.ai/threats/cve-2026-112370-a-vulnerability-was-found-in-h3c-magic-nx15-100r017-this-issue) (critical, CVSS 9.9, published 19 Oct 2026) - [CVE-2025-29296: H3C Magic and NX series command injection in API](https://junglewise.ai/threats/cve-2025-29296-h3c-magic-and-nx-series-command-injection-in-api) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2023-54405: H3C CVM unauthenticated arbitrary file upload](https://junglewise.ai/threats/cve-2023-54405-h3c-cvm-the-cloud-virtualization-management-component-of-the-h3c) (critical, CVSS 9.8, published 2 Oct 2026) - [CVE-2025-60262: An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a…](https://junglewise.ai/threats/cve-2025-60262-an-issue-in-h3c-m102g-hm1a0v200r010-wireless-controller-and) (critical, CVSS 9.8, published 6 Jan 2026) - [CVE-2025-14015: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file…](https://junglewise.ai/threats/cve-2025-14015-a-weakness-has-been-identified-in-h3c-magic-b0-up-to-100r002-this) (high, CVSS 8.8, published 4 Dec 2025) - [CVE-2026-9393: H3C Magic B0 buffer overflow in Edit_BasicSSID_5G](https://junglewise.ai/threats/cve-2026-9393-h3c-magic-b0-buffer-overflow-in-edit-basicssid-5g) (high, CVSS 8.8, published 24 May 2026) - [CVE-2026-10259: H3C Magic B0 stack overflow in SetMobileAPInfoById](https://junglewise.ai/threats/cve-2026-10259-h3c-magic-b0-stack-overflow-in-setmobileapinfobyid) (high, CVSS 8.8, published 1 Jun 2026) - [CVE-2025-44653: H3C GR2200 resource exhaustion in bftpd configuration](https://junglewise.ai/threats/cve-2025-44653-h3c-gr2200-resource-exhaustion-in-bftpd-configuration) (high, CVSS 7.5, published 21 Jul 2025) - [CVE-2026-18810: H3C NX15 authentication bypass in network setup API](https://junglewise.ai/threats/cve-2026-18810-h3c-nx15-authentication-bypass-in-network-setup-api) (high, CVSS 7.3, published 4 Aug 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up 300% on the four before (1). 2 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 1 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## H3C technologies - [H3C NX15](https://junglewise.ai/threats/technologies/nx15): 9 vulnerabilities - [H3C Magic NX15](https://junglewise.ai/threats/technologies/magic-nx15): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "H3C vulnerabilities", https://junglewise.ai/threats/vendors/h3c, 12 November 2026.