CVE-2026-73722: Arubanetworks Fabric Composer RCE Vulnerability

CVE-2026-73722 Overview

CVE-2026-73722 is a command injection vulnerability in the web-based management interface of HPE Networking Fabric Composer (formerly Aruba Networks Fabric Composer). An authenticated remote attacker with high privileges can inject operating system commands through the management interface. Successful exploitation allows the attacker to execute arbitrary commands as a privileged user on the underlying operating system. The vulnerability is tracked under CWE-78 (OS Command Injection) and CWE-77 (Command Injection).

Critical Impact

Authenticated attackers can execute arbitrary OS commands as a privileged user, resulting in full compromise of the Fabric Composer host and the network fabric it manages.

Affected Products

• HPE Networking Fabric Composer (Aruba Networks Fabric Composer)
• All versions prior to the fix documented in the HPE Security Bulletin
• Deployments exposing the web-based management interface to network-accessible clients

Discovery Timeline

• 2026-09-01 - CVE-2026-73722 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73722

Vulnerability Analysis

The vulnerability resides in the web-based management interface of HPE Networking Fabric Composer. User-supplied input from authenticated sessions reaches an operating system command execution context without sufficient sanitization or safe API usage. An attacker who submits crafted input containing shell metacharacters can break out of the intended command and append arbitrary commands. Because the management daemon runs with elevated privileges, injected commands execute in a privileged context on the underlying host.

Fabric Composer centrally orchestrates data center switching fabrics. Compromise of the host grants the attacker programmatic control over managed switches, configuration data, and any credentials stored on the appliance. This positions the flaw as a pivot point for lateral movement into the data plane and adjacent management networks.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command, consistent with CWE-78. Input received through authenticated management endpoints is concatenated into shell commands rather than passed through parameterized execution APIs. Metacharacters such as ;, |, &, $(), and backticks are not stripped or escaped before invocation.

Attack Vector

The attack vector is network-based and requires authentication with high privileges. An attacker with a valid administrative or elevated account on Fabric Composer sends a crafted HTTP request to a vulnerable management endpoint. The injected payload is executed by the underlying shell as the service user, yielding arbitrary command execution.

No public proof-of-concept or exploit code is currently available. See the HPE Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-73722

Indicators of Compromise

• Unexpected child processes spawned by the Fabric Composer web application service, particularly sh, bash, python, curl, wget, or nc.
• Outbound network connections from the Fabric Composer host to unfamiliar IP addresses or domains shortly after administrative HTTP requests.
• New or modified files under system directories, cron entries, or SSH authorized_keys on the Fabric Composer appliance.
• Web access logs containing shell metacharacters such as ;, |, &&, $(, or backticks in POST bodies or URL parameters to management endpoints.

Detection Strategies

• Correlate authenticated administrative API calls with subsequent process creation events on the appliance to surface command-injection chains.
• Alert on any interactive shell or scripting interpreter spawned as a child of the Fabric Composer web service process tree.
• Baseline normal outbound connectivity from the appliance and alert on deviations, especially to non-corporate destinations.

Monitoring Recommendations

• Ship Fabric Composer web, audit, and system logs to a centralized SIEM for retention and correlation across administrative sessions.
• Monitor authentication events for privileged accounts and investigate any use from unexpected source networks or at anomalous times.
• Track configuration changes on managed switches and correlate them with Fabric Composer administrative activity to detect unauthorized fabric changes.

How to Mitigate CVE-2026-73722

Immediate Actions Required

• Apply the vendor-supplied update referenced in the HPE Security Bulletin as soon as possible.
• Restrict network access to the Fabric Composer management interface to a dedicated management VLAN and trusted administrator jump hosts.
• Rotate credentials for all privileged Fabric Composer accounts and any secrets stored on the appliance after patching.
• Review audit logs for suspicious administrative activity dating back to the earliest available retention window.

Patch Information

HPE has published a security bulletin (hpesbnw05133en_us) describing fixed versions and remediation guidance for HPE Networking Fabric Composer. Administrators should consult the HPE Security Bulletin for exact fixed release numbers and upgrade instructions.

Workarounds

• Enforce strict network segmentation so that only authorized administrator workstations can reach the Fabric Composer web interface.
• Require multi-factor authentication and use unique, least-privilege accounts for Fabric Composer administration to reduce the population of accounts capable of exploitation.
• Disable or remove unused administrative accounts and integrate authentication with a centralized identity provider for consistent revocation.

# Example: restrict access to the Fabric Composer management UI with iptables
# Replace 10.0.10.0/24 with your management network CIDR
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP