CVE-2026-73724: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability in HPE Fabric Composer's API permits an authenticated user with low privilege to escalate their privileges by changing the state of certain settings on the system. The issue is classified under CWE-269 (Improper Privilege Management). It affects version 7.0.0 of the product. The CVSS v3.1 base score is 7.1, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No patch or official remediation level has been disclosed by the vendor yet.

Successful exploitation allows an authenticated low privilege operator to escalate privileges by modifying critical system settings, potentially impacting system integrity and availability. Confidentiality is not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API to trusted users only and monitor for suspicious activity related to configuration changes. Follow vendor updates for official patches or mitigations.