HPE Fabric Composer CVE-2026-73713

Exploitation requires an existing local authenticated session on the HPE Fabric Composer host system with at minimum low-privilege OS credentials (consistent with PR:L in the CVSS vector). No remote or network-based exploitation vector exists (AV:L). No user interaction is needed once local access is established (UI:N), and the low attack complexity (AC:L) means no race conditions or specialized environment setup is required. Limiting factors: the attacker must first obtain local access through a separate vector (credential theft, physical access, or prior compromise of a co-hosted service). Environments with strict single-purpose Fabric Composer hosts and tightly controlled local login access are meaningfully less exposed than shared-access deployments.

The CVSS 7.8 High score is grounded in a realistic threat model: local access with low privileges escalating to root. The AV:L vector substantially limits the population of potential attackers compared to network-exploitable flaws - an adversary must already have a foothold on the Fabric Composer host before exploitation. No EPSS score was provided, precluding probabilistic exploitation likelihood comparison. No CISA KEV entry exists and no POC has been identified, so the current exploitation status is unknown. The low complexity (AC:L) and absence of user interaction (UI:N) mean that once local access is achieved, exploitation is straightforward. In environments where the Fabric Composer host is shared across administrative roles or accessed by multiple service accounts, this significantly elevates risk, as any compromise of a lower-privileged account becomes a direct path to full OS control. The missing CWE introduces uncertainty about whether a single fix closes all paths or whether multiple independent vulnerabilities require separate patches.

An attacker who has compromised a low-privilege service account or OS user on the Fabric Composer host - for example, via a phishing-delivered credential or lateral movement from another system - triggers one of the identified privilege-escalation flaws to obtain a root shell on the appliance. From root, the attacker can modify network fabric configurations, exfiltrate management credentials, or pivot deeper into the fabric infrastructure. No public POC has been identified, so exploitation complexity beyond local access is currently unknown.