CVE-2026-73724

CVE-2026-73724 describes privilege escalation flaws in the API of HPE Aruba Networking Fabric Composer, a data center fabric orchestration platform, caused by incorrect or insufficient authorization checks (CWE-863, CWE-269). A remote attacker who already holds valid credentials for a low-privilege operator account can issue API requests that change the state of certain system settings that operator-level users should not be able to modify. Successful exploitation yields a high integrity impact (unauthorized changes to settings) and a low availability impact, with no confidentiality impact, since the flaws do not expose data. Any organization running an affected release of Fabric Composer is exposed, with exploitation requiring only network access to the management API and an operator-level account. Exploitation has not been observed: there is no known in-the-wild activity, no public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Check the HPE Aruba Networking security advisory for CVE-2026-73724 and upgrade Fabric Composer to the fixed version it specifies, as the available data does not include version numbers. In the meantime, restrict access to the Fabric Composer API to trusted networks and review recent changes to system settings for modifications made by operator-level accounts. Limit operator-level API credentials to users who genuinely need them.