CVE-2026-73708: Fault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable system.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege operator user can exploit the vulnerable API. The issue is remotely reachable over the network and does not require user interaction.
What could an attacker do after exploitation?
The attacker could obtain elevated privileges and modify settings beyond those authorized for their existing account. The stated impact includes high confidentiality and integrity impact, with low availability impact.
Are unauthenticated users affected?
The provided information describes exploitation by an authenticated low-privilege operator user. It does not indicate that unauthenticated access is sufficient.