CVE-2026-73701CWE-94code-injection

CVE-2026-73701

Critical · published September 2, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer< 7.3.47.3.4
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:31Z
    Unauthenticated Remote Code Execution in HPE Networking Fabric Composer
    cvelistv5