EUVD-2026-69427
GHSA-frfg-9ff5-gj83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege operator credentials
-
DeliverySend crafted API request to Fabric Composer
-
ExploitTrigger insufficient authorization check
-
ExecutionEscalate session to administrator
-
ImpactAchieve full system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privilege 'operator' user account on the HPE Networking Fabric Composer instance, confirmed by the CVSS PR:L metric. No special non-default configuration, specific feature enablement, or physical access is required - the attack is conducted entirely over the network-accessible API (AV:N/AC:L/UI:N). The sole limiting factor is possession of operator-level credentials; unauthenticated exploitation is not possible per the PR:L vector. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the threat profile: network-reachable, low attack complexity, requiring only a low-privilege credential, with full confidentiality, integrity, and availability impact on the compromised system. The absence of a CISA KEV listing and any public POC lowers immediate urgency relative to actively exploited vulnerabilities, but the combination of AC:L and PR:L means the bar for exploitation is simply 'have any valid operator account,' which is a realistic attacker capability in most enterprise deployments. EPSS data is not present in the available sources, so exploitation probability cannot be quantified. The S:U scope metric limits blast radius to the Fabric Composer system itself, but full administrative compromise of a network orchestration platform carries substantial downstream risk to all managed network infrastructure. The CPE wildcard version range suggests NVD has not yet been updated with a fixed version, making patch targeting imprecise without direct reference to the HPE advisory. |
| Exploit ScenarioDerived | An attacker with a valid low-privilege operator account - obtained via credential theft, phishing, or insider access - crafts a malicious API request that triggers the authorization enforcement gap, escalating their session to full administrative privileges. With admin control over Fabric Composer, the attacker can reconfigure managed network infrastructure, exfiltrate sensitive topology and credential data, or cause network-wide disruption. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
RemediationAI
Consult the HPE Security Bulletin HPESBNW05133en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the official patch and exact fixed version. An exact patched version is not independently confirmed from available data - the CPE wildcard version range indicates NVD has not yet been updated with the remediated release. As compensating controls pending patch application, restrict operator account provisioning to the minimum necessary personnel and audit existing operator accounts for anomalous API activity. Additionally, limit network access to the Fabric Composer API to dedicated management VLANs or jump hosts, reducing the AV:N attack surface; note that this does not remediate the underlying authorization flaw and will impact legitimate management workflows if not planned carefully.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is an enterprise network orchestration and management platform providing API-driven control over HPE network infrastructure. The vulnerability resides in the API layer, where authorization checks are insufficient to enforce the boundary between the operator role and the administrator role. No CWE is assigned in the available data, but the root cause class is consistent with CWE-269 (Improper Privilege Management) or CWE-285 (Improper Authorization) - the API does not correctly validate whether an operator-level session is entitled to perform administrative operations. The affected CPE (cpe:2.3:a:hewlett_packard_enterprise_(hpe):fabric_composer:*:*:*:*:*:*:*:*) uses a wildcard version field, implying all tracked releases are considered vulnerable pending vendor clarification.
Know when Fabric Composer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requiring only a low-privilege credential with no interaction; full triad impact on Fabric Composer upon successful privilege escalation to admin.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.
Executive ViewAI
HPE Networking Fabric Composer API contains a privilege escalation vulnerability enabling authenticated operator-level users to gain full administrative control over the network without user interaction. This poses a significant insider threat, as any operator account holder-including those with compromised credentials-can escalate to complete system compromise.
Restrict network access to HPE Fabric Composer API to trusted management networks only; minimize operator account issuance to essential personnel; enable comprehensive logging and alerting on privilege escalation and administrative actions; audit and revoke inactive operator credentials regularly; consider enabling multi-factor authentication for operator accounts if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent netwo
Exploit-DB