CVE-2026-73706

CVE-2026-73706 is a missing-authentication flaw (CWE-306) in the API of HPE Aruba Networking Fabric Composer, HPE's orchestration platform for Aruba data-center fabrics. Because the affected API endpoints accept unauthenticated network requests, a remote attacker needs no credentials or user interaction to trigger the issue. A successful attacker gains limited system information (insight into internal services and workflows) and can change the state of certain settings, potentially disrupting the normal operation of the affected service. Only organizations running HPE Aruba Networking Fabric Composer are affected; the 8.6 (High) CVSS score reflects network exploitation with low confidentiality and availability impact but high integrity impact. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade Fabric Composer to the fixed release identified in the HPE security advisory (fixed version not stated in this data). Until patching, restrict API access to trusted management networks and review managed settings for unexpected or unauthorized changes. Given no known PoC or in-the-wild exploitation, urgent exposure beyond patching is not indicated.