CVE-2026-73701 (CVSS 3.1 base score 9.0, Critical) is an unauthenticated remote code execution vulnerability in the underlying operating system of HPE Aruba Networking Fabric Composer. No privileges or user interaction are required to exploit it, but HPE's description notes that exploitation depends on certain preconditions outside the attacker's control being met, which is reflected in the CVSS vector's High attack complexity rating rather than the Low complexity seen in the related SSH-daemon and API bypass flaws. HPE has not published further detail on what those preconditions are.

CVE-2026-73701 was disclosed on 1 September 2026 in the same HPE security bulletin as CVE-2026-76657, CVE-2026-76658, and CVE-2026-73700, three further critical vulnerabilities in the same product that CERTVU addressed in Advisory 230, Advisory 226, and Advisory 231 respectively. This is a distinct, fourth vulnerability rather than a duplicate of any of those. Successful exploitation results in arbitrary code execution as a privileged user on the underlying operating system, leading to complete compromise of the AFC host, consistent with the other advisories in this bulletin.

• HPE Aruba Networking Fabric Composer 7.0.0 – Affected

See HPE Security Bulletin HPESBNW05133 for the fixed release and update package – Not affected, patched.

CERTVU advises verifying HPE's public bulletin (docId HPESBNW05133) as the authoritative source for the specific fixed version and download package, which covers CVE-2026-73701 alongside CVE-2026-76657, CVE-2026-76658, and CVE-2026-73700.

Typical attack flow:

• Step 1 - Reach an Affected AFC Host Under the Right Conditions An attacker identifies an HPE Aruba Networking Fabric Composer host reachable over the network, where the unspecified preconditions required for this flaw happen to be met.
• Step 2 - Achieve Remote Code Execution on the Underlying Operating System The attacker exploits the underlying operating-system vulnerability to execute arbitrary code as a privileged user, with no authentication or user interaction required once the preconditions are satisfied.

Attack vectors:

• Network access to an affected AFC host — no authentication, prior access, or user interaction is required, though the flaw depends on preconditions outside the attacker's control that HPE has not detailed.
• Particular risk where the AFC host is reachable from outside a trusted management network or the internet, increasing the chance that any qualifying preconditions are met by an opportunistic attacker.

Successful exploitation may allow attackers to:

• Execute arbitrary code as a privileged user on the underlying operating system of the AFC host.
• Achieve complete compromise of the network fabric management platform, with downstream risk to every switch fabric that AFC instance administers.

CERTVU recommends the following:

1. Apply the HPE Fix Without Delay
   • Consult HPE Security Bulletin HPESBNW05133 for the specific fixed release and apply it to every affected Fabric Composer 7.0.0 instance. If your organization has already patched for CVE-2026-76657, CVE-2026-76658, or CVE-2026-73700 (Advisories 230, 226, and 231), confirm that same update also resolves CVE-2026-73701 rather than assuming it.
2. Restrict network exposure of the AFC host.
3. Treat AFC as a high-value target pending patching.
4. Audit the estate for the affected product.
5. Conduct a compromise assessment.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.