Description
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to view sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further privileges on the affected system.
Published: 2026-09-01
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Apply Patch
AI Analysis

Impact

A flaw in the underlying operating system of HPE Networking Fabric Composer permits an authenticated operator with low privileges and local access to read sensitive data. The data exposed could subsequently aid an attacker in escalating privileges on the same system. The weakness corresponds to inadequate protection of confidential information.

Affected Systems

The vulnerability affects Hewlett Packard Enterprise Fabric Composer devices. No specific firmware or software version numbers are listed in the CNA data, indicating that the issue may exist across available releases until a vendor fix is deployed.

Risk and Exploitability

The CVSS score of 4.7 classifies the flaw as moderate severity. Because the exploit requires local authenticated access, it cannot be triggered remotely and its EPSS score is not provided. The vulnerability is not recorded in CISA’s KEV catalog, suggesting no known public exploitation. Nonetheless, the potential for privilege escalation warrants prompt attention.

Generated by OpenCVE AI on September 2, 2026 at 01:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest HPE Networking Fabric Composer patch or upgrade to a fixed version
  • Enforce the principle of least privilege for local operator accounts, limiting file read permissions only to necessary system components
  • Continuously monitor system logs for anomalous access patterns to sensitive files and review file permissions regularly

Generated by OpenCVE AI on September 2, 2026 at 01:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks fabric Composer
CPEs cpe:2.3:a:arubanetworks:fabric_composer:*:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks fabric Composer

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) fabric Composer
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) fabric Composer

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to view sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further privileges on the affected system.
Title Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Arubanetworks Fabric Composer
Hewlett Packard Enterprise (hpe) Fabric Composer
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-01T20:24:46.571Z

Reserved: 2026-08-13T16:37:26.897Z

Link: CVE-2026-73738

cve-icon Vulnrichment

Updated: 2026-09-01T20:14:52.038Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-01T20:17:21.427

Modified: 2026-09-03T15:12:17.967

Link: CVE-2026-73738

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T16:44:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor