CVE-2026-73735: Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated low-privilege operator account for the HPE Networking Fabric Composer API. The issue is remotely exploitable and does not require user interaction.
What could an attacker do after exploiting it?
A successful attacker could access limited information and make limited changes outside the permissions normally assigned to their account. The available data does not identify the specific information or operations affected.
Is an unauthenticated or default deployment affected?
The vulnerability requires low-privilege authentication, so it is not described as exploitable by an unauthenticated attacker. The provided information does not state whether any particular default configuration is affected.