CVE-2026-73707: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability (CVE-2026-73707) in HPE Fabric Composer's API permits an authenticated user with low privilege to escalate their authorization level and execute state-changing operations that should be restricted. The flaw relates to improper authorization checks (CWE-863). It impacts Fabric Composer version 7.0.0. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability can cause a complete scope change with high impact on integrity and low impact on availability. No vendor advisory or patch is currently available.

An authenticated low privilege operator can perform unauthorized configuration changes on systems managed by Fabric Composer, potentially compromising system integrity. This could lead to unauthorized modifications that affect the managed network infrastructure. There is no indication of confidentiality impact or denial of service beyond low availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fabric Composer API to trusted users only and monitor for suspicious activity related to privilege escalation attempts.