CVE-2026-73705

HPE Aruba Networking Fabric Composer contains an arbitrary file write flaw (CWE-552) in its API that allows an authenticated low-privilege operator user to escalate privileges. An attacker triggers it via crafted API requests that write files to arbitrary locations, requiring only network access to the API, valid operator credentials, and no user interaction (per the CVSS vector AV:N/AC:L/PR:L/UI:N). Successful exploitation can result in arbitrary command execution on the underlying operating system, giving the attacker complete compromise of the Fabric Composer system, which orchestrates HPE Aruba data center switching fabrics. Organizations running Fabric Composer are affected, but the available data does not specify which versions are vulnerable or patched. There is no known public proof-of-concept, no CISA KEV listing, and EPSS is low (0.3%, 28th percentile), so no exploitation has been confirmed to date.

What to do: Check HPE's security advisory (issued via [email protected]) for patched Fabric Composer releases and upgrade, since fixed versions are not stated in this data. Until patched, restrict the Fabric Composer API to trusted management networks and minimize the number of operator-level accounts, because exploitation requires valid operator credentials. Monitor the appliance for unexpected privilege changes or unexplained operating-system commands.