CVE-2026-73712: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability in HPE Fabric Composer's API permits unauthenticated remote attackers to run arbitrary OS commands on the host system, contingent on specific conditions outside the attacker's control. The flaw is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The affected version explicitly identified is 7.0.0. There is no vendor advisory or patch information available at this time.

If exploited, the vulnerability could allow attackers to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise including unauthorized access, data manipulation, and service disruption. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor HPE advisories closely and consider restricting network access to the Fabric Composer API to trusted sources to reduce exposure.