CVE-2026-73718CWE-352csrf

CVE-2026-73718

High · published September 2, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer< 7.3.47.3.4
References (1)
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:46Z
    Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer
    cvelistv5