HPE Fabric Composer CVE-2026-73719

Exploitation requires valid administrative credentials to the HPE Fabric Composer API (PR:H per CVSS vector). No additional special configuration or non-default feature enablement is described - the vulnerability exists in the core API exposed to admin users. The primary limiting factor is the requirement for prior administrative-level authentication to Fabric Composer, making this an insider threat, compromised-credential, or privilege-abuse scenario rather than an external unauthenticated attack. Network access to the management API endpoint is also required (AV:N). There is no user interaction required beyond the attacker's own API calls (UI:N).

The CVSS 7.2 base score reflects the high-privilege requirement (PR:H) that substantially limits exposure - only users who already hold administrative credentials to Fabric Composer can trigger this. Despite the C:H/I:H/A:H impact triad (achievable because the escalation lands at OS root), the realistic threat population is narrow: this is an insider threat or compromised-admin scenario, not a remote anonymous attack. EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC has been identified, suggesting it is not being actively mass-exploited. The primary real-world risk is privilege escalation in environments where administrative Fabric Composer accounts are shared, poorly protected, or accessible to semi-trusted operators who should not have OS-level access. Organizations running Fabric Composer with strict admin credential hygiene and network-segmented management interfaces face materially lower risk than those with broadly shared admin accounts.

An attacker who has compromised or legitimately holds administrative credentials to the Fabric Composer management API sends a crafted API request specifying a privileged OS file path (such as /etc/cron.d/ or /root/.ssh/authorized_keys) as the write target, injecting attacker-controlled content. The file write succeeds under the API process context, and the attacker triggers execution of the written payload - for example, a cron job or SSH key - gaining an interactive root shell on the underlying operating system.