High severity · published Sep 1, 2026
CVE-2026-73711
Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Fabric Composer · Hewlett Packard Enterprise (HPE)
7.0.0 through 7.3.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73711
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US
More from Fabric Composer
10.0
CVE-2026-76658
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon
10.0
CVE-2026-76657
Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access
9.6
CVE-2026-19766
Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer
9.0
CVE-2026-73701
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer
9.0
CVE-2026-73700
Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface