CVE-2026-73713

HPE has disclosed local privilege-escalation vulnerabilities (CWE-269, improper privilege management) in HPE Networking Fabric Composer, the Aruba fabric orchestration appliance. An attacker who already has a low-privileged foothold on the system — via a compromised admin account, shell access, or another flaw — can exploit the condition locally without user interaction. Successful exploitation yields arbitrary code execution with root privileges on the underlying operating system of the appliance, giving full control over the orchestration host. Organizations running HPE/Aruba Fabric Composer to orchestrate their data center switching fabrics are affected, though the local attack vector means only parties with access to the appliance's OS are exposed. No public proof-of-concept, no entries in CISA KEV, and a very low EPSS (0.1%, 1st percentile) indicate no known exploitation at this time.

What to do: Check the HPE security bulletin (CNA: [email protected]) for the fixed Fabric Composer release applicable to your deployment and upgrade promptly. Until patched, restrict console/SSH and other local access to the appliance's underlying OS to trusted administrators and limit accounts with low-privileged shell access. Since the flaw is local and unexploited, no emergency action is required, but prioritize patching in the next maintenance window.