Description
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal services and workflows and to make unauthorized changes that may disrupt the normal operation of the affected service.
Published: 2026-09-01
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the API of Hewlett Packard Enterprise Fabric Composer allows an unauthenticated remote user to retrieve limited system information and to modify the state of certain settings. Successful exploitation could reveal internal services and workflows and permit the attacker to make unauthorized changes that might disrupt normal operation of the affected service.

Affected Systems

Hewlett Packard Enterprise Fabric Composer, with no version details specified in the advisory. The product is a network fabric composition platform used to orchestrate networking infrastructure.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.6, indicating high severity. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog, but the lack of authentication requirement and remote API exposure mean an attacker can exploit it from an external network. The high CVSS rating and remote nature suggest a significant risk if not addressed promptly.

Generated by OpenCVE AI on September 2, 2026 at 01:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch for HPE Fabric Composer as provided by Hewlett Packard Enterprise
  • If a patch is not yet available, restrict inbound access to the Fabric Composer API by firewalling or placing the appliance behind a VPN
  • Disable or remove unused API endpoints that expose configuration changes

Generated by OpenCVE AI on September 2, 2026 at 01:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal services and workflows and to make unauthorized changes that may disrupt the normal operation of the affected service.
Title Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-01T20:24:20.548Z

Reserved: 2026-08-13T16:35:39.127Z

Link: CVE-2026-73706

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T20:17:17.977

Modified: 2026-09-01T21:08:28.570

Link: CVE-2026-73706

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T01:30:19Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control