HPE Fabric Composer CVE-2026-73729

Exploitation requires: (1) an authenticated session as a low-privilege 'operator' role user within HPE Fabric Composer; (2) local access to the host system where AFC and its upstream dependencies reside - remote network-only access is insufficient per the AV:L vector. No user interaction by a higher-privileged user is needed once the attacker has the operator session. The key limiting factors are the mandatory authentication (PR:L) and mandatory local system access (AV:L), which together mean the attacker must either be a legitimate but malicious operator, have compromised an existing operator credential, or have already achieved some form of local access to the AFC host. Default AFC deployments with operator accounts in use are potentially affected; deployments where operator accounts are unused or where local OS access is tightly restricted (e.g., jump-host only, no direct shell) have substantially reduced exposure.

CVSS base score of 6.5 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N correctly captures the key risk dimensions: local access is mandatory (AV:L), authentication as a low-privilege operator is required (PR:L), and the scope change (S:C) with high confidentiality impact (C:H) elevates the score despite the local-only vector. EPSS data is not present in the provided intelligence, and the vulnerability is not in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No POC is identified. Real-world priority is moderate: exploitation is constrained to actors who already have authenticated local access as an operator-level account, substantially reducing the attack surface compared to a network-accessible vulnerability. However, the S:C/C:H combination means successful exploitation could expose credentials, configuration secrets, or other sensitive OS-level data that enables privilege escalation or lateral movement, making post-exploitation impact meaningful. Organizations running AFC in shared-operator environments or where operator accounts are granted to multiple personnel should treat this as higher priority.

An attacker who has obtained or been granted a low-privilege operator account on an HPE Fabric Composer deployment gains local shell or equivalent access and navigates to upstream AFC dependency directories on the underlying OS. By reading files in those paths - configuration files, credential stores, certificates, or service tokens - the attacker retrieves sensitive data beyond what the operator role should permit, potentially obtaining credentials that enable escalation to higher-privilege AFC or OS roles.