CVE-2026-73707

Modified Modified - Updated After Analysis

Privilege Escalation in HPE Networking Fabric Composer API

Publication date: 2026-09-01

Last updated on: 2026-09-02

Assigner: Hewlett Packard Enterprise (HPE)

Description

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, including changes to the configuration of systems managed by the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-02

Generated

2026-09-22

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73707

EUVD

EUVD-2026-69434

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	fabric_composer	to 7.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation issue in the API of HPE Networking Fabric Composer. It allows an authenticated low-privilege operator user to perform unauthorized state-changing actions that exceed their assigned authorization level. This includes modifying configurations of systems managed by the product.

Detection Guidance

Detection requires checking for unauthorized API state-changing actions by low-privilege users. Monitor HPE Networking Fabric Composer API logs for actions exceeding user authorization levels. No specific commands are provided in the available context.

Impact Analysis

An attacker with low privileges could exploit this to make unauthorized changes to system configurations, potentially disrupting operations or gaining further access. The impact depends on the affected systems but could lead to data breaches or service disruptions.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or changes to sensitive data or systems. GDPR and HIPAA require strict access controls and auditability; such unauthorized actions could lead to non-compliance and potential penalties.

Mitigation Strategies

Immediately restrict API access to authenticated low privilege operator users by reviewing and updating authorization policies. Ensure only necessary administrative actions are permitted for operator roles. Monitor API logs for unusual state-changing actions or unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-73707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70