CVE-2026-73718

high

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive info…

Vendor / product: Arubanetworks — fabric composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.

CVSS

7.4

7.4 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (security-alert@hpe.com)

Timeline (UTC)

Published: 2026-09-01 20:17

Modified: 2026-09-02 16:17

NVD status: Modified

Last synced 2 days ago

Verified against the source API 2026-10-27 06:50 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

arubanetworks / fabric_composer <7.3.4

Weakness classification (CWE)

NVD-CWE-noinfo CWE-352

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US security-alert@hpe.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-73718

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs