Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against… (CVE-2026-73721)

This vulnerability involves SQL injection flaws in the API of HPE Networking Fabric Composer. An attacker with valid authentication can exploit these flaws to execute arbitrary SQL commands on the underlying database. This can result in unauthorized disclosure and modification of sensitive data, and may lead to complete compromise of the host system running the affected software. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated remote attacker to obtain and alter sensitive information stored in the Fabric Composer's database. This can lead to a complete compromise of the host system, affecting confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, restrict access to the API to trusted users only and monitor for suspicious activity. Do not assume the vulnerability is mitigated without official vendor confirmation.