# CVE-2026-73701: HPE Networking Fabric Composer unauthenticated remote code execution

Source: https://junglewise.ai/threats/cve-2026-73701-hpe-networking-fabric-composer-unauthenticated-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73701 · Severity: critical · CVSS 9 · Published 2026-09-01

HPE Networking Fabric Composer is a network management platform used to orchestrate fabric configurations across HPE networking infrastructure. An unauthenticated remote attacker can exploit a vulnerability in the underlying operating system to execute arbitrary code with privileged access, completely compromising the management host and potentially the entire managed network infrastructure.

Technologies: [Arubanetworks Fabric Composer](https://junglewise.ai/threats/technologies/fabric-composer), [Hpe Networking Fabric Composer](https://junglewise.ai/threats/technologies/networking-fabric-composer). Vendors: [Arubanetworks](https://junglewise.ai/threats/vendors/arubanetworks), [Hpe](https://junglewise.ai/threats/vendors/hpe).

## Quick answers

**Is CVE-2026-73701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73701 being exploited in the wild.

**How severe is CVE-2026-73701?** Critical severity, with a CVSS score of 9, published 1 September 2026.

**Which products and versions are affected?** HPE Networking Fabric Composer.

**Is there a fix for CVE-2026-73701?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73701 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-73701?** Check whether you run Arubanetworks Fabric Composer or Hpe Networking Fabric Composer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code with privileged user permissions on the underlying operating system. Successful exploitation requires certain preconditions to be met that are outside of the attacker's direct control. An exploit would result in complete compromise of the affected Fabric Composer host, potentially enabling lateral movement and control of managed networking resources.

## Affected products

- HPE Networking Fabric Composer

## Timeline

- 2026-09-01: disclosed

## References

- [https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US)

## Related threats

- [HPE Networking Fabric Composer API race condition](https://junglewise.ai/threats/cve-2026-95772-a-race-condition-vulnerability-exists-in-the-api-of-hpe)
- [HPE Networking Fabric Composer information disclosure in API](https://junglewise.ai/threats/cve-2026-95771-an-authenticated-information-disclosure-vulnerability-exists-in)
- [HPE Networking Fabric Composer information disclosure in OS](https://junglewise.ai/threats/cve-2026-95770-a-sensitive-information-disclosure-vulnerability-in-the)
- [HPE Networking Fabric Composer audit log spoofing](https://junglewise.ai/threats/cve-2026-95769-an-audit-log-spoofing-vulnerability-exists-in-the-api-of-hpe)
- [HPE Networking Fabric Composer API privilege escalation](https://junglewise.ai/threats/cve-2026-95768-a-privilege-escalation-vulnerability-exists-in-the-api-of-hpe)