EUVD-2026-69577
GHSA-cxhr-f495-3m45
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent-network reach (AV:A) with no auth or interaction and low complexity; auth bypass yields privileged OS code execution beyond the component, so S:C and C/I/A all High.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.
AnalysisAI
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the AFC host (CVSS AV:A) - the attacker must be on the same logical/Layer 2 or management network segment, not the open Internet - but needs no credentials (PR:N) and no user interaction (UI:N), and the attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals present are strong but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release identified in HPE Security Bulletin hpesbnw05133en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US); the exact patched version is not present in the provided structured data and must be read directly from that advisory, so cite it from the bulletin rather than assuming a number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all HPE Fabric Composer deployments and map their network placement-specifically determine which systems reside on network segments reachable by untrusted or shared adjacent networks, and immediately implement VLAN isolation or firewall rules restricting Layer 2/3 access from adjacent network zones to AFC hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent netwo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today