CVE-2026-73720: HPE Fabric Composer RCE Vulnerability

CVE-2026-73720 Overview

CVE-2026-73720 is a remote code execution vulnerability in the API of HPE Networking Fabric Composer, formerly known as Aruba Networks Fabric Composer. The flaw stems from insecure file operations exposed through the product's API. An authenticated remote attacker with high privileges can abuse these operations to execute arbitrary commands as a privileged user on the underlying operating system. HPE published a security bulletin tracked as hpesbnw05133en_us addressing the issue. The vulnerability maps to two Common Weakness Enumeration categories: OS Command Injection [CWE-78] and External Control of File Name or Path [CWE-73].

Critical Impact

Successful exploitation grants arbitrary command execution as a privileged operating system user, giving attackers full control over the fabric management plane.

Affected Products

• HPE Networking Fabric Composer (Aruba Networks Fabric Composer)
• Deployments exposing the Fabric Composer API to authenticated users
• Environments running versions listed in HPE bulletin hpesbnw05133en_us

Discovery Timeline

• 2026-09-01 - CVE-2026-73720 published to the National Vulnerability Database
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73720

Vulnerability Analysis

HPE Networking Fabric Composer provides an API for automating network fabric operations. The API contains endpoints that perform file operations without properly validating or sanitizing user-supplied input. An authenticated attacker can influence file paths or file content processed by these endpoints. That influence extends into shell command construction on the underlying operating system, resulting in command execution as a privileged account. The chained weaknesses (CWE-73 file path control and CWE-78 OS command injection) confirm that attacker-controlled file references are consumed by a downstream shell context. The attack is remote and requires low complexity, but privileged API access is a prerequisite.

Root Cause

The root cause is missing input validation on file-related API parameters. Fabric Composer accepts file paths or names from authenticated API callers and forwards them to backend routines that invoke operating system commands. Without strict allowlisting or safe path handling, an attacker crafts input that is interpreted as command arguments or shell metacharacters. The service runs with elevated privileges, so injected commands inherit those privileges.

Attack Vector

Exploitation requires network access to the Fabric Composer API and valid credentials with high privileges. The attacker authenticates, then issues a crafted API request targeting the vulnerable file operation endpoint. The payload embeds shell metacharacters or manipulated path components. The service executes the injected command as the privileged runtime user. No user interaction is required. Refer to the HPE Security Bulletin for the specific affected endpoints and versions.

No public proof-of-concept exploit is available at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.699%.

Detection Methods for CVE-2026-73720

Indicators of Compromise

• Unexpected child processes spawned by the Fabric Composer service account, especially shells such as sh, bash, or python.
• API requests to file-handling endpoints containing shell metacharacters (;, |, `, $()) or path traversal sequences (../).
• New or modified files in Fabric Composer working directories that do not correspond to legitimate administrative activity.
• Outbound network connections originating from the Fabric Composer host to unfamiliar destinations.

Detection Strategies

• Enable and centralize Fabric Composer API access logs, then alert on file-operation endpoints invoked by non-administrative service accounts.
• Baseline the process tree of the Fabric Composer service and alert on deviations, particularly interactive shells or scripting interpreters.
• Inspect authentication logs for privileged API sessions originating from unusual source addresses or at anomalous times.

Monitoring Recommendations

• Forward host and application telemetry from Fabric Composer appliances to a centralized analytics platform for correlation.
• Monitor file integrity on Fabric Composer configuration and binary directories.
• Track privileged credential usage against the Fabric Composer API and enforce alerting on failed-then-successful login patterns.

How to Mitigate CVE-2026-73720

Immediate Actions Required

• Apply the patched Fabric Composer release identified in HPE bulletin hpesbnw05133en_us as soon as testing allows.
• Restrict Fabric Composer API access to a dedicated management network and trusted administrator jump hosts.
• Rotate credentials for any privileged accounts that can authenticate to the Fabric Composer API.
• Review API access logs for indicators consistent with the exploitation pattern described above.

Patch Information

HPE has released fixed versions through the HPE Security Bulletin. Administrators should consult the bulletin for the exact fixed build numbers that correspond to their deployed Fabric Composer version and apply them following HPE upgrade guidance.

Workarounds

• Limit high-privilege API tokens and revoke any tokens that are not strictly required for automation.
• Place the Fabric Composer management interface behind a VPN or bastion host until the patch is applied.
• Enforce multi-factor authentication for all administrators with Fabric Composer access to reduce the risk of credential compromise enabling exploitation.