CVE-2026-73720CWE-73CWE-78command-injection

CVE-2026-73720

High · published September 2, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01058 · 64.2th percentile
Weaknesses
CWE-73 · External Control of File Name or Path; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/fabric_composer< 7.3.47.3.4
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 01 SEP 19:46Z
    Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API
    cvelistv5