CVE-2026-73708

CVE-2026-73708 is a business logic flaw (CWE-863, incorrect authorization) in the API of HPE Aruba Networking Fabric Composer. It is triggered when an authenticated low-privilege operator issues API requests that bypass the platform's authorization checks, allowing actions beyond the operator's assigned privilege level. A successful attacker gains elevated privileges on the vulnerable system and can modify settings they should not be able to change, with high impact on confidentiality and integrity and low impact on availability per the CVSS score of 8.3. Only organizations running HPE Aruba Networking Fabric Composer, HPE's orchestration platform for data center networking fabrics, are affected. There is no evidence of exploitation in the wild, no known public proof-of-concept, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade Fabric Composer to the fixed release identified in HPE's security advisory for CVE-2026-73708, since exact version numbers are not available in this data. Until patched, restrict API access to trusted management networks and review which accounts hold the operator role. Audit recent settings changes made by operator-level accounts to detect any prior privilege abuse.