CVE-2026-73721
Modified Modified - Updated After Analysis

SQL Injection in HPE Networking Fabric Composer API

Publication date: 2026-09-01

Last updated on: 2026-09-02

Assigner: Hewlett Packard Enterprise (HPE)

Description
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-02
Generated
2026-09-22
AI Q&A
2026-09-02
EPSS Evaluated
2026-09-21
NVD
CVE-2026-73721
EUVD
EUVD-2026-69448

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arubanetworks fabric_composer to 7.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SQL injection flaws in the API of HPE Networking Fabric Composer. An authenticated remote attacker could exploit these flaws to manipulate database queries, potentially accessing or altering sensitive data stored in the system.

Impact Analysis

If exploited, this vulnerability could allow an attacker to obtain and modify sensitive information in the database, leading to complete compromise of the HPE Networking Fabric Composer host. This may result in unauthorized access to critical system data or control.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, which may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Unauthorized database access risks exposing personal or health data, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Apply patches or updates provided by HPE to address SQL injection vulnerabilities in the API of HPE Networking Fabric Composer. Ensure authentication mechanisms are strengthened and restrict access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart