Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API

published 2026-09-01 2 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-69462

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-09-01)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Hewlett Packard Enterprise (HPE) Fabric Composer

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties

References

support.hpe.com /hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US
vendor-advisory

Sources

CVE List CVE-2026-73735
NVD CVE-2026-73735

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary