CVE-2026-73737: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability (CVE-2026-73737) affects HPE Fabric Composer 7.0.0 and involves an unauthenticated path traversal in its API endpoint. Exploitation requires an adjacent attacker and certain preconditions outside the attacker's control. Successful exploitation could allow unauthorized manipulation of user-generated files, leading to potential unauthorized changes in critical system configurations. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N). No known exploits are reported in the wild and no vendor patch or official remediation level is currently documented.

If exploited, this vulnerability could allow an unauthenticated attacker on an adjacent network to manipulate user-generated files, potentially causing unauthorized changes to critical system configurations. This could affect the integrity of the system but does not impact confidentiality or availability. The attack complexity is high and user interaction is required, which reduces the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by Hewlett Packard Enterprise as of the publication date. Users should monitor HPE advisories for updates and consider restricting network access to the affected API endpoint to trusted users where possible.