CVE-2026-73714: Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API
A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further unauthorized access.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
HPE Networking Fabric Composer deployments are exposed where an authenticated low-privilege operator account can access the API. The issue does not describe unauthenticated exploitation.
What does an attacker need to exploit it?
An attacker needs valid credentials for a low-privilege operator user and network access to the affected API. No user interaction is required, and the attack complexity is rated low.
What could a successful attacker access or do?
A successful attacker could access sensitive data beyond the permissions assigned to their existing account. The disclosed information could potentially enable further unauthorized access.
How can defenders determine whether they may already be affected?
Review API activity by low-privilege operator accounts for requests or data access outside their expected authorization scope. The provided information does not identify specific affected versions or indicators of compromise.