EUVD-2026-69430
GHSA-v8m8-3qg6-2wc8
Severity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:A confirmed by management interface scoping; PR:N per unauthenticated injection; S:C and high C/I/A reflect admin session compromise on network infrastructure manager.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
AnalysisAI
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network adjacency to the HPE Fabric Composer management interface - typically meaning presence on the management VLAN, data center management subnet, or a network segment with direct routing to the management interface IP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) captures the key risk drivers accurately: the management interface appears accessible only on adjacent network segments (AV:A), reducing the exposed attack surface compared to internet-facing services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the vendor-released patched version - an exact fix version is not independently confirmed from the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, review Fabric Composer access logs for injection attempts or unusual administrator activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent netwo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today