CVE-2026-73707CWE-863broken-access-control

CVE-2026-73707

High · published September 2, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, including changes to the configuration of systems managed by the affected product.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer< 7.3.47.3.4
References (1)
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:46Z
    Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API
    cvelistv5