CVE-2026-73701

CVE-2026-73701 is an unauthenticated remote code execution flaw (code injection, CWE-94) in the underlying operating system of HPE Networking Fabric Composer, HPE Aruba's data-center network orchestration software. A remote attacker without credentials can attempt exploitation over the network, but success depends on certain preconditions outside the attacker's control, which is reflected in the high attack complexity of the 9.0 CVSS score. If those conditions are met, the attacker can execute arbitrary code as a privileged user on the host operating system, resulting in full compromise of the Fabric Composer host. Any organization running Fabric Composer deployments is potentially affected, though the product is a specialized on-premises management appliance rather than a mass-market endpoint. There is currently no known public proof-of-concept, no listing in CISA KEV, and a low 0.5% EPSS probability of exploitation in the next 30 days.

What to do: Monitor the HPE/Aruba security bulletin assigned by [email protected] for patched Fabric Composer releases and upgrade promptly once fixed versions are published; no fixed version numbers are provided in the current data. Until patched, restrict access to the Fabric Composer host to trusted management networks and avoid exposing it to the internet. Because exploitation requires preconditions outside the attacker's control and no public PoC exists, opportunistic exploitation risk is currently low, but re-check advisories and EPSS/KEV status as conditions evolve.