{"id":"CVE-2026-73711","aliases":["EUVD-2026-69438","GHSA-pg3x-fw53-hr52"],"status":"published","title":"Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API","description":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00457,"percentile":0.40103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-09-01T19:46:35Z","modified":"2026-09-02T16:16:57Z","products":[{"vendor":"arubanetworks","product":"fabric_composer"},{"vendor":"hewlett packard enterprise (hpe)","product":"fabric composer"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us\u0026docLocale=en_US","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73711"},{"url":"https://github.com/advisories/GHSA-pg3x-fw53-hr52"}],"sources":{"cve":[{"id":"CVE-2026-73711","title":"Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API","description":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.","status":"published","published":"2026-09-01T19:46:35.829Z","modified":"2026-09-02T14:16:24.205Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-69438","description":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.","status":"published","published":"2026-09-01T19:46:35Z","modified":"2026-09-02T14:16:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:15.49101Z"}],"ghsa":[{"id":"GHSA-pg3x-fw53-hr52","title":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer...","description":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.","status":"published","published":"2026-09-01T21:31:48Z","modified":"2026-09-02T15:35:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:11:17.291346Z"}],"nvd":[{"id":"CVE-2026-73711","description":"A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.","status":"published","published":"2026-09-01T20:17:18.51Z","modified":"2026-09-02T16:16:57.783Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:43.04945Z"}]}}