CVE-2026-73717: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability (CVE-2026-73717) affects HPE Fabric Composer version 7.0.0. It is a command injection flaw in the web management interface that could permit an unauthenticated remote attacker to run arbitrary OS commands if specific conditions outside the attacker's control are satisfied. Successful exploitation results in full system compromise. The CVSS v3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented.

An attacker exploiting this vulnerability could execute arbitrary commands on the underlying operating system of the affected HPE Fabric Composer device, potentially leading to complete system compromise. This includes full control over the device, which could impact confidentiality, integrity, and availability of the system and its managed network fabric.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation instructions are currently available. Until a patch is released, restrict access to the web-based management interface and monitor for suspicious activity. Follow vendor updates closely for any forthcoming patches or mitigations.