CVE-2026-73706: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability in HPE Fabric Composer's API permits unauthenticated remote attackers to gain limited system information and alter the state of specific settings. The flaw could enable attackers to understand internal services and workflows and perform unauthorized modifications that may disrupt the affected system's normal operation. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). It affects version 7.0.0 of the product. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts including low confidentiality, high integrity, and low availability.

Successful exploitation allows an unauthenticated attacker to gain insight into internal services and workflows and to make unauthorized changes to system settings. This can disrupt normal operation and compromise system integrity. Confidentiality impact is limited, but integrity impact is high, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Until a patch is available, restrict network access to the Fabric Composer API to trusted users and monitor for unusual activity related to configuration changes.