{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-73736",
        "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "state": "PUBLISHED",
        "assignerShortName": "hpe",
        "dateReserved": "2026-08-13T16:37:26.897Z",
        "datePublished": "2026-09-01T19:47:16.871Z",
        "dateUpdated": "2026-09-01T20:24:44.813Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "affected",
                    "product": "Fabric Composer",
                    "vendor": "Hewlett Packard Enterprise (HPE)",
                    "versions": [
                        {
                            "lessThanOrEqual": "7.3.3",
                            "status": "affected",
                            "version": "7.0.0",
                            "versionType": "semver"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "reporter",
                    "value": "This vulnerability was discovered by internal security research at HPE Networking."
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "baseScore": 5.3,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "LOW",
                        "availabilityImpact": "NONE",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
                "shortName": "hpe",
                "dateUpdated": "2026-09-01T20:24:44.813Z"
            },
            "references": [
                {
                    "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US"
                }
            ],
            "source": {
                "advisory": "HPESBNW05133",
                "discovery": "INTERNAL"
            },
            "title": "Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer",
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "problemTypes": [
                    {
                        "descriptions": [
                            {
                                "type": "CWE",
                                "cweId": "CWE-552",
                                "lang": "en",
                                "description": "CWE-552 Files or Directories Accessible to External Parties"
                            }
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-09-01T20:16:31.023500Z",
                                "id": "CVE-2026-73736",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-09-01T20:16:33.399Z"
                }
            }
        ]
    }
}