CVE-2026-73704: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability in HPE Fabric Composer 7.0.0 arises from insufficient command sanitization in its API. An authenticated user with low privilege operator access can exploit this flaw to escalate their permissions to those of an administrative user. The vulnerability is tracked as CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated low privilege operator user to gain administrative privileges, resulting in complete compromise of the affected system. This includes full control over the Fabric Composer environment, which could impact network fabric management and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict operator-level access to trusted personnel only and monitor for suspicious activity related to Fabric Composer API usage.