CVE-2026-73712

Modified Modified - Updated After Analysis

Remote Command Execution in HPE Networking Fabric Composer API

Publication date: 2026-09-01

Last updated on: 2026-09-03

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-03

Generated

2026-09-22

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73712

EUVD

EUVD-2026-69439

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	fabric_composer	to 7.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host of HPE Networking Fabric Composer if certain external conditions are met. Successful exploitation could lead to full system compromise by granting the attacker control over the operating system.

Detection Guidance

Detection requires checking for HPE Networking Fabric Composer installations and verifying if the API is exposed to unauthenticated access. Inspect network traffic for unusual API requests or command execution patterns. Use network scanning tools like nmap to identify exposed API endpoints. Check system logs for unexpected command executions or unauthorized access attempts.

Impact Analysis

If exploited, this vulnerability could allow attackers to take complete control of the affected system, potentially leading to data theft, system damage, or unauthorized access to sensitive information. It poses a high risk due to the potential for full system compromise.

Compliance Impact

This vulnerability could lead to complete system compromise by allowing arbitrary command execution on the underlying operating system. Such a breach may result in unauthorized access to sensitive data, which could violate compliance requirements under GDPR, HIPAA, or other regulations depending on the data processed.

Mitigation Strategies

Apply vendor-provided patches or updates for HPE Networking Fabric Composer immediately. Isolate affected systems from untrusted networks. Monitor network traffic for unusual activity. Restrict API access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-73712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70