CVE-2026-73704CWE-77command-injection

CVE-2026-73704

High · published September 2, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00534 · 44.2th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer< 7.3.47.3.4
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:46Z
    Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API
    cvelistv5