CVE-2026-73721

HPE Networking Fabric Composer contains SQL injection vulnerabilities (CWE-89) in its API that allow an authenticated remote attacker to send crafted input that is executed against the underlying database of the Fabric Composer instance. The CVSS vector requires high-privileged credentials (PR:H), meaning exploitation needs a valid account with elevated rights rather than any unauthenticated or low-privilege user. A successful attack can read and modify sensitive information in the database and, per HPE, may escalate to complete compromise of the Fabric Composer host. Only organizations running HPE/Aruba Networking Fabric Composer to orchestrate and manage data center networking are affected. There is currently no known exploitation in the wild, no public proof-of-concept, and a low (~0.4%) 30-day exploitation probability per EPSS.

What to do: Apply the fixed release identified in the HPE security bulletin (fixed versions were not specified in this dataset) and restrict access to the Fabric Composer API and management interface to trusted administrative networks. Audit which accounts hold high-privilege credentials, since exploitation requires them, and monitor those accounts for anomalous API activity. Given the potential for full host compromise, include the Fabric Composer appliance in incident-response scope if compromise is suspected.