CVE-2026-73710

HPE (Aruba) Networking Fabric Composer contains a missing-authentication flaw (CWE-306) in one of its API endpoints, meaning requests to that interface do not require any credentials. An unauthenticated remote attacker can send crafted requests to this API endpoint to disrupt the availability of the affected system and make limited unauthorized modifications to the underlying operating system, with recovery requiring manual intervention. Any organization running HPE Aruba Networking Fabric Composer is affected, although the advisory data available here does not specify which versions are impacted or identify a fixed release. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Review the HPE security bulletin for CVE-2026-73710 and upgrade Fabric Composer to the fixed release it specifies, since no version numbers are given in the advisory data available here. Until patching, restrict access to the Fabric Composer API endpoint to trusted management networks using ACLs or firewall rules, and be prepared for manual recovery because successful attacks can make limited OS changes and take the system down.