{ "document": { "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "HPE Networking has released updates for HPE Networking Fabric Composer that address multiple vulnerabilities described in this advisory.", "title": "Summary" }, { "category": "general", "text": "These vulnerabilities affect the following HPE Networking Fabric Composer versions unless specifically noted otherwise in the Details section below: \n \n - HPE Networking Fabric Composer 7.3.3 and below \n \nNOTE: Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. For deployments running software versions that are past End of Support (EoS), HPE Networking has not assessed exposure to the vulnerabilities referenced in this advisory. As a result, such installations should be considered potentially impacted by the listed CVEs. Customers are strongly encouraged to upgrade to a supported software release to ensure proper evaluation and remediation.", "title": "Affected Products" }, { "category": "general", "text": "Any other HPE Networking products not specifically listed above are not affected by these vulnerabilities.", "title": "Unaffected Products" }, { "category": "other", "text": "These vulnerabilities were all discovered by internal security research at HPE Networking. HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory. Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.", "title": "Exploitation and Public Discussion" }, { "category": "general", "text": "Complete information on reporting security vulnerabilities in HPE Networking products and obtaining assistance with security incidents is available at:\nhttps://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us\n \nFor reporting *NEW* HPE Networking security issues, email can be sent to networking-sirt(at)hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at:\nhttps://www.hpe.com/info/psrt-pgp-key", "title": "HPE Networking SIRT Security Procedures" }, { "category": "legal_disclaimer", "text": "(c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information.", "title": "Legal Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "Email: networking-sirt(at)hpe.com - For further details please see http://www.hpe.com/support/security-response-policy", "issuing_authority": "HPE Networking's Security Incident Response Team (SIRT) is responsible for receiving, tracking, managing, and disclosing vulnerabilities in HPE Networking products. The HPE Networking SIRT actively works with industry, non-profit, government organizations, and the security community when vulnerabilities are reported. A security vulnerability is defined as any weakness in a product that allows an attacker to compromise the confidentiality, integrity, or availability of a product, customer infrastructure, or IT system through an HPE Networking product in that environment.", "name": "HPE Networking", "namespace": "http://www.hpe.com/support/security-response-policy" }, "references": [ { "summary": "Original Advisory", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US" }, { "summary": "HPE Networking Security Advisory Archive", "url": "https://csaf.arubanetworking.hpe.com/" }, { "summary": "HPE Networking Product Security Incident Response Policy", "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us" } ], "title": "Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC)", "tracking": { "current_release_date": "2026-09-01T16:00:00.000Z", "generator": { "date": "2026-08-26T19:32:27.475Z", "engine": { "name": "Secvisogram", "version": "2.6.9" } }, "id": "HPESBNW05133", "initial_release_date": "2026-09-01T16:00:00.000Z", "revision_history": [ { "date": "2026-09-01T16:00:00.000Z", "number": "1", "summary": "Initial Publication" } ], "status": "draft", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "AFC 7.4.0", "product": { "name": "HPE Networking Fabric Composer", "product_id": "7.4.0" } }, { "category": "product_version", "name": "AFC 7.3.4", "product": { "name": "HPE Networking Fabric Composer", "product_id": "7.3.4" } }, { "category": "product_version_range", "name": "vers:semver/>=7.0.0|<=7.3.3", "product": { "name": "HPE Networking Fabric Composer", "product_id": ">=7.0.0|<=7.3.3" } } ], "category": "product_name", "name": "Fabric Composer" } ], "category": "vendor", "name": "HPE Networking" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-76657", "notes": [ { "category": "details", "text": "Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.", "title": "Details" }, { "category": "other", "text": "VULN-862, VULN-906, VULN-917, VULN-934, VULN-946", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 10, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 10, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-76658", "notes": [ { "category": "details", "text": "A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.", "title": "Details" }, { "category": "other", "text": "VULN-918", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 10, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 10, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-19766", "notes": [ { "category": "details", "text": "An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.", "title": "Details" }, { "category": "other", "text": "VULN-876", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.7, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 9.6, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73700", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.", "title": "Details" }, { "category": "other", "text": "VULN-892, VULN-894, VULN-927, VULN-931, VULN-855", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 9, "temporalSeverity": "CRITICAL", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73701", "notes": [ { "category": "details", "text": "An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.", "title": "Details" }, { "category": "other", "text": "VULN-913, VULN-914, VULN-923, VULN-924, VULN-859, VULN-870, VULN-919", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 9, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Remote Code Execution in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73702", "notes": [ { "category": "details", "text": "A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.", "title": "Details" }, { "category": "other", "text": "VULN-891", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Privilege Escalation Vulnerability in the API of HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73703", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.", "title": "Details" }, { "category": "other", "text": "VULN-895", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.9, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73704", "notes": [ { "category": "details", "text": "A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-904, VULN-930, VULN-945", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73705", "notes": [ { "category": "details", "text": "An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary commands on the underlying operating system, leading to complete compromise of the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-912", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "mitigation", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73706", "notes": [ { "category": "details", "text": "A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal services and workflows and to make unauthorized changes that may disrupt the normal operation of the affected service.", "title": "Details" }, { "category": "other", "text": "VULN-916", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "mitigation", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73707", "notes": [ { "category": "details", "text": "Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, including changes to the configuration of systems managed by the affected product.", "title": "Details" }, { "category": "other", "text": "VULN-899, VULN-909, VULN-911, VULN-928", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 8.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73708", "notes": [ { "category": "details", "text": "A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable system.", "title": "Details" }, { "category": "other", "text": "VULN-879", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.3, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.3, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Fault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73709", "notes": [ { "category": "details", "text": "A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.", "title": "Details" }, { "category": "other", "text": "VULN-920", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.4, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 8.3, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73710", "notes": [ { "category": "details", "text": "Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the availability of the affected system, requiring manual intervention to restore functionality.", "title": "Details" }, { "category": "other", "text": "VULN-903, VULN-926", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.2, "environmentalSeverity": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73711", "notes": [ { "category": "details", "text": "A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.", "title": "Details" }, { "category": "other", "text": "VULN-864", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73712", "notes": [ { "category": "details", "text": "A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.", "title": "Details" }, { "category": "other", "text": "VULN-872", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Remote Code Execution in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73713", "notes": [ { "category": "details", "text": "Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow a local attacker to achieve arbitrary code execution with root privileges on the underlying operating system of the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-871, VULN-944, VULN-849, VULN-910, VULN-868, VULN-867", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73714", "notes": [ { "category": "details", "text": "A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further unauthorized access.", "title": "Details" }, { "category": "other", "text": "VULN-880", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.6, "environmentalSeverity": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73715", "notes": [ { "category": "details", "text": "A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.", "title": "Details" }, { "category": "other", "text": "VULN-846, VULN-847, VULN-889", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73716", "notes": [ { "category": "details", "text": "A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.", "title": "Details" }, { "category": "other", "text": "VULN-915", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Remote Code Execution in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73717", "notes": [ { "category": "details", "text": "A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.", "title": "Details" }, { "category": "other", "text": "VULN-925", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73718", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.", "title": "Details" }, { "category": "other", "text": "VULN-874", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.4, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 7.4, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73719", "notes": [ { "category": "details", "text": "An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.", "title": "Details" }, { "category": "other", "text": "VULN-860", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73720", "notes": [ { "category": "details", "text": "Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.", "title": "Details" }, { "category": "other", "text": "VULN-844", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73721", "notes": [ { "category": "details", "text": "Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host.", "title": "Details" }, { "category": "other", "text": "VULN-902, VULN-941", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73722", "notes": [ { "category": "details", "text": "Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.", "title": "Details" }, { "category": "other", "text": "VULN-866, VULN-897, VULN-929, VULN-936", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73723", "notes": [ { "category": "details", "text": "A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform.", "title": "Details" }, { "category": "other", "text": "VULN-873", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73724", "notes": [ { "category": "details", "text": "Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.", "title": "Details" }, { "category": "other", "text": "VULN-890, VULN-938", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73725", "notes": [ { "category": "details", "text": "A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges, leading to a complete compromise of the affected host.", "title": "Details" }, { "category": "other", "text": "VULN-850", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Local Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73726", "notes": [ { "category": "details", "text": "A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.", "title": "Details" }, { "category": "other", "text": "VULN-878", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.8, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 6.8, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73727", "notes": [ { "category": "details", "text": "Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A successful exploit allows an attacker to access data beyond what is authorized by the user's existing privilege level, which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.", "title": "Details" }, { "category": "other", "text": "VULN-893, VULN-865, VULN-907, VULN-933, VULN-943, VULN-932", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73728", "notes": [ { "category": "details", "text": "Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.", "title": "Details" }, { "category": "other", "text": "VULN-896, VULN-937", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Denial of Service Vulnerabilities in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73729", "notes": [ { "category": "details", "text": "A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to upstream AFC dependencies to view sensitive information. Successful exploitation could allow an attacker to access data beyond what is authorized by the user's existing privilege level, potentially leading to further unauthorized access.", "title": "Details" }, { "category": "other", "text": "VULN-922", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73730", "notes": [ { "category": "details", "text": "A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.", "title": "Details" }, { "category": "other", "text": "VULN-898, VULN-908, VULN-942", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73731", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.", "title": "Details" }, { "category": "other", "text": "VULN-882", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 6.1, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 6.1, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73732", "notes": [ { "category": "details", "text": "A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensitive data which could be used to gain further unauthorized access to the affected system and to other systems it interacts with.", "title": "Details" }, { "category": "other", "text": "VULN-921", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 5.6, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 5.6, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Local Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73733", "notes": [ { "category": "details", "text": "Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should have been revoked.", "title": "Details" }, { "category": "other", "text": "VULN-861, VULN-901", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authentication Bypasses in API allow Continued Authenticated Access in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73734", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.", "title": "Details" }, { "category": "other", "text": "VULN-886", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Open Redirect allows URL Manipulation in HPE Networking Fabric Composer Web Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "These vulnerabilities were discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73735", "notes": [ { "category": "details", "text": "Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level.", "title": "Details" }, { "category": "other", "text": "VULN-900, VULN-940", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73736", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.", "title": "Details" }, { "category": "other", "text": "VULN-854, VULN-884, VULN-885, VULN-905, VULN-935", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73737", "notes": [ { "category": "details", "text": "An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations, if certain preconditions outside of the attacker's control are met.", "title": "Details" }, { "category": "other", "text": "VULN-863", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 4.8, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 4.8, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Path Traversal in HPE Networking Fabric Composer API Endpoint Allows Unauthorized File Modification" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73738", "notes": [ { "category": "details", "text": "A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to view sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further privileges on the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-877", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 4.7, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 4.7, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73739", "notes": [ { "category": "details", "text": "A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve sensitive information that was expected to remain protected within the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-845, VULN-851, VULN-857, VULN-888, VULN-856", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 4.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 4.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73740", "notes": [ { "category": "details", "text": "A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-869", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 4.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 4.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Local Privilege Escalation in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73741", "notes": [ { "category": "details", "text": "A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level.", "title": "Details" }, { "category": "other", "text": "VULN-881", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 4.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73742", "notes": [ { "category": "details", "text": "A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-939", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 4.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73743", "notes": [ { "category": "details", "text": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. A successful exploit could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.", "title": "Details" }, { "category": "other", "text": "VULN-875", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "environmentalScore": 3.7, "environmentalSeverity": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 3.7, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Information Disclosure Leading to Data Exposure in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73744", "notes": [ { "category": "details", "text": "A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.", "title": "Details" }, { "category": "other", "text": "VULN-853", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "environmentalScore": 3.5, "environmentalSeverity": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 3.5, "temporalSeverity": "LOW", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73745", "notes": [ { "category": "details", "text": "A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access when combined with other vulnerabilities.", "title": "Details" }, { "category": "other", "text": "VULN-883", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "environmentalScore": 3.1, "environmentalSeverity": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 3.1, "temporalSeverity": "LOW", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73746", "notes": [ { "category": "details", "text": "A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.", "title": "Details" }, { "category": "other", "text": "VULN-887", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "environmentalScore": 3.1, "environmentalSeverity": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 3.1, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer API" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73747", "notes": [ { "category": "details", "text": "A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system.", "title": "Details" }, { "category": "other", "text": "VULN-852", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "environmentalScore": 2.5, "environmentalSeverity": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 2.5, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Local Privilege Escalation Vulnerability in HPE Networking Fabric Composer" }, { "acknowledgments": [ { "organization": "HPE Networking", "summary": "This vulnerability was discovered by internal security research at HPE Networking." } ], "cve": "CVE-2026-73748", "notes": [ { "category": "details", "text": "A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.", "title": "Details" }, { "category": "other", "text": "VULN-848", "title": "Internal References" } ], "product_status": { "fixed": [ "7.4.0", "7.3.4" ], "known_affected": [ ">=7.0.0|<=7.3.3" ] }, "remediations": [ { "category": "vendor_fix", "date": "2026-09-01T16:00:00.000Z", "details": "To resolve all the vulnerabilities in the affected software branches that are addressed through this advisory, HPE Networking strongly recommends upgrading the HPE Networking Fabric Composer software to one of the following versions (as applicable): \n \n - HPE Networking Fabric Composer 7.4.x: 7.4.0 and above \n - HPE Networking Fabric Composer 7.3.x: 7.3.4 and above \n \nSoftware versions with resolution/fixes for the vulnerabilities in this advisory can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/. \n \nProduct software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Networking does not evaluate or patch software branches that have reached their End of Support (EoS) milestone.", "product_ids": [ "7.4.0", "7.3.4" ], "url": "https://networkingsupport.hpe.com/home/" }, { "category": "workaround", "date": "2026-09-01T16:00:00.000Z", "details": "To minimize the likelihood of an attacker exploiting this vulnerability, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.", "product_ids": [ ">=7.0.0|<=7.3.3" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "environmentalScore": 2.2, "environmentalSeverity": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 2.2, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ ">=7.0.0|<=7.3.3" ] } ], "title": "Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer" } ] }