Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information… (CVE-2026-73735)

CVE-2026-73735 describes vulnerabilities in the API of HPE Networking Fabric Composer that permit an authenticated user with low privilege operator access to obtain information or perform actions beyond their assigned privileges. This results from improper access control in the API, classified under CWE-552 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability does not require user interaction and has a network attack vector. The impact includes limited confidentiality and integrity loss but no availability impact.

Exploitation allows an authenticated low privilege operator user to gain limited unauthorized access to information and make limited unauthorized changes beyond their existing privilege level. There is no indication of availability impact or broader privilege escalation. No known exploits are reported in the wild.

No patch or official remediation information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated operator user access to trusted personnel and monitor for unusual activity consistent with privilege abuse.