HPE Fabric Composer CVE-2026-73736

The HPE Fabric Composer web-based management interface must be reachable from the attacker's network - CVSS AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated complexity, and no user interaction are required. Exploitation is limited to reading files within a single affected directory; the description does not specify which directory, so the exact scope of exposed data (configuration, logs, credentials) is unknown without vendor clarification. The primary limiting factor is network accessibility: organizations that place the management interface on an isolated management VLAN or behind a firewall restricting access to administrator hosts are not exposed to remote unauthenticated attackers.

CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes a medium-severity information-disclosure path that is trivially reachable from the network without credentials or user interaction, but with limited confidentiality impact. The C:L metric signals only partial information exposure - files within a bounded directory rather than unrestricted filesystem access. No EPSS score is included in the available intelligence, and the vulnerability is absent from CISA KEV, making active widespread exploitation unlikely. No public proof-of-concept has been identified. Despite its network-reachable, zero-authentication nature, the bounded impact (one directory, no integrity or availability consequences) keeps this below the threshold of urgent emergency response; even a mid-tier operator should nonetheless prioritize patching given management-interface exposure. The HPE advisory (HPESBNW05133) is the sole reference, and no specific affected-version ceiling is confirmed.

An unauthenticated attacker with network access to the Fabric Composer management interface sends HTTP GET requests to file-serving endpoints that lack access control, retrieving system files from the vulnerable directory. Because no credentials or user interaction are required and attack complexity is low, exploitation is straightforward with basic tooling such as curl. No public proof-of-concept is known, but the attack surface is simple enough to be independently reproduced by a moderately skilled attacker.