CVE-2026-73724

Modified Modified - Updated After Analysis

Privilege Escalation in HPE Networking Fabric Composer API

Publication date: 2026-09-01

Last updated on: 2026-09-02

Assigner: Hewlett Packard Enterprise (HPE)

Description

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-02

Generated

2026-09-22

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73724

EUVD

EUVD-2026-69451

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	fabric_composer	to 7.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation issue in the API of HPE Networking Fabric Composer. It allows an authenticated low privilege operator user to change certain system settings, potentially gaining unauthorized control.

Detection Guidance

This vulnerability requires authentication and involves privilege escalation in HPE Networking Fabric Composer API. Detection may involve checking API logs for unauthorized state changes, monitoring user privilege modifications, or inspecting network traffic for suspicious API calls targeting the Fabric Composer service.

Impact Analysis

An attacker could exploit this to modify system settings, leading to unauthorized changes, data breaches, or service disruptions. The impact depends on the affected system's role in your infrastructure.

Compliance Impact

This vulnerability allows an authenticated low privilege user to escalate privileges and modify system settings, which could lead to unauthorized access or data manipulation. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized changes to sensitive configurations.

Mitigation Strategies

Update HPE Networking Fabric Composer to the latest patched version to address privilege escalation vulnerabilities. Restrict API access to authenticated users only and review user permissions to ensure low privilege operators cannot modify system settings.

Hi! I’m here to help you understand CVE-2026-73724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70