CVE-2026-73727: arubanetworks fabric_composer Incorrect Authorization
Vulnerability summary
CVE-2026-73727 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in arubanetworks fabric_composer. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26% of scored vulnerabilities.
Timeline
- 01-09-2026PublishedVulnerability first disclosed.
- 02-09-2026Last modifiedVulnerability information updated.
Description
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A successful exploit allows an attacker to access data beyond what is authorized by the user's existing privilege level, which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
+0.14 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Arubanetworks1 product
- fabric_composer< 7.3.4
Hewlett packard enterprise (hpe)1 product
- fabric composer≥ 7.0.0, ≤ 7.3.3
2 vendors · 2 products