{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-73735",
        "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "state": "PUBLISHED",
        "assignerShortName": "hpe",
        "dateReserved": "2026-08-13T16:37:26.897Z",
        "datePublished": "2026-09-01T19:47:15.537Z",
        "dateUpdated": "2026-09-01T20:24:44.067Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "affected",
                    "product": "Fabric Composer",
                    "vendor": "Hewlett Packard Enterprise (HPE)",
                    "versions": [
                        {
                            "lessThanOrEqual": "7.3.3",
                            "status": "affected",
                            "version": "7.0.0",
                            "versionType": "semver"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "reporter",
                    "value": "This vulnerability was discovered by internal security research at HPE Networking."
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "baseScore": 5.4,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "LOW",
                        "availabilityImpact": "NONE",
                        "integrityImpact": "LOW",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
                "shortName": "hpe",
                "dateUpdated": "2026-09-01T20:24:44.067Z"
            },
            "references": [
                {
                    "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US"
                }
            ],
            "source": {
                "advisory": "HPESBNW05133",
                "discovery": "INTERNAL"
            },
            "title": "Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API",
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "problemTypes": [
                    {
                        "descriptions": [
                            {
                                "type": "CWE",
                                "cweId": "CWE-552",
                                "lang": "en",
                                "description": "CWE-552 Files or Directories Accessible to External Parties"
                            }
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-09-01T20:16:43.721803Z",
                                "id": "CVE-2026-73735",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-09-01T20:16:56.439Z"
                }
            }
        ]
    }
}