HPE Fabric Composer CVE-2026-73721

Exploitation requires an authenticated session with high-privilege (administrator-level) credentials on the HPE Networking Fabric Composer instance, as confirmed by the CVSS PR:H metric. The attacker must also have network-level access to the Fabric Composer API endpoint. No special non-default configuration beyond valid admin credentials is required - the API is the standard management interface. Unauthenticated exploitation is not possible. Exploitation is bounded by: the requirement for prior credential acquisition (insider threat, credential stuffing, phishing, or lateral movement), and any network segmentation or firewall rules restricting access to the management API port.

The CVSS 3.1 base score of 7.2 (High) is calibrated by PR:H, which meaningfully narrows the attack surface to actors already holding administrative credentials - this rules out opportunistic internet-scale exploitation. AC:L and UI:N indicate no special timing or user-interaction is required once credentials are in hand. The C:H/I:H/A:H impact triad, combined with HPE's explicit 'complete compromise of the host' language, suggests SQL injection with a privileged database account could chain into OS-level command execution through database-native features. EPSS data is absent from the provided input; KEV status is negative and no POC is known, indicating this has not yet attracted broad attacker interest. Real-world risk is highest where the Fabric Composer management API is exposed on shared or flat networks and administrator accounts are reused or weakly protected. The absence of a confirmed fixed-version in CPE metadata is a gap: defenders cannot confirm whether a patch is yet available without consulting the HPE bulletin directly.

An attacker who has phished, reused, or otherwise obtained high-privilege Fabric Composer administrator credentials authenticates to the API and submits crafted SQL payloads in API request parameters. Successful injection allows wholesale exfiltration of the management database - including network topology, credentials, and configuration - and, if the database process holds OS-level permissions, may chain into remote command execution on the Fabric Composer host itself.