CVE-2026-73704: Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API
Vulnerability summary
CVE-2026-73704 is a high (CVSS 8.8) Command Injection vulnerability in arubanetworks fabric_composer. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities.
Timeline
- 01-09-2026PublishedVulnerability first disclosed.
- 02-09-2026Last modifiedVulnerability information updated.
Description
A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
Increase +0.22 pp
From 0.32% on 23-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Arubanetworks1 product
- fabric_composer< 7.3.4
Hewlett packard enterprise (hpe)1 product
- fabric composer≥ 7.0.0, ≤ 7.3.3
2 vendors · 2 products