CVE-2026-73735: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability in HPE Fabric Composer's API permits an authenticated user with low privilege to access or modify data beyond their intended access rights. The issue is classified under CWE-552 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and limited confidentiality and integrity impact without availability impact. The affected version explicitly identified is 7.0.0. No patch or official remediation level has been published yet, and there are no known exploits in the wild.

An attacker with authenticated low privilege access can obtain limited sensitive information and make limited unauthorized changes beyond their privilege level. This could lead to information disclosure and integrity issues within the Fabric Composer environment but does not affect availability or allow full privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict low privilege operator user access to trusted personnel only and monitor for unusual activity consistent with privilege abuse.