Unauthenticated Path Traversal in HPE Networking Fabric Composer
CVE-2026-73737

4.8MEDIUM

Key Information:

Vendor

HP (HP)

Status
Fabric Composer
Vendor
CVE Published:
1 September 2026

What is CVE-2026-73737?

An unauthenticated path traversal vulnerability exists within the API endpoint of HPE Networking Fabric Composer. This issue allows an adjacent attacker to potentially manipulate user-generated files, leading to unauthorized alterations in critical system configurations. Successful exploitation of this vulnerability requires the attacker to meet specific preconditions that are not under their control. Organizations using this product should assess their systems for potential exposure and apply necessary updates to mitigate risks.

Affected Version(s)

Fabric Composer 7.0.0 <= 7.3.3

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Unknown contributor
.