CVE-2026-23593 Unauthenticated Limited File Read allows Data Exposure in Web Interface
Unauthenticated attackers can read system files via path traversal in the HPE Aruba Fabric Composer web interface, leading to data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23593?
CVE-2026-23593 is a high-severity path traversal vulnerability in Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabric Composer, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-23593?
How do I fix CVE-2026-23593?
No fix has been published for CVE-2026-23593 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23593 being exploited?
There is no known exploitation of CVE-2026-23593 in the wild and no public exploit code.
Sources
Also known as GHSA-8fmp-6g38-h9j8.