CVE-2026-73723: arubanetworks fabric_composer Incorrect Authorization
Vulnerability summary
CVE-2026-73723 is a high (CVSS 7.1) Incorrect Authorization vulnerability in arubanetworks fabric_composer. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.2% of scored vulnerabilities.
Timeline
- 01-09-2026PublishedVulnerability first disclosed.
- 02-09-2026Last modifiedVulnerability information updated.
Description
A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
+0.02 pp
From 0.35% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Arubanetworks1 product
- fabric_composer< 7.3.4
Hewlett packard enterprise (hpe)1 product
- fabric composer≥ 7.0.0, ≤ 7.3.3
2 vendors · 2 products