EUVD-2026-69440
GHSA-mwww-vcqh-25fc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local foothold with low privileges suffices to reach root; no interaction needed; full CIA impact on the host OS aligns with root code execution.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow a local attacker to achieve arbitrary code execution with root privileges on the underlying operating system of the affected system.
AnalysisAI
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing local authenticated session on the HPE Fabric Composer host system with at minimum low-privilege OS credentials (consistent with PR:L in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High score is grounded in a realistic threat model: local access with low privileges escalating to root. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US) for the patched release version and upgrade instructions, as no specific fixed version number was included in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Fabric Composer deployments and document current versions; immediately restrict console and SSH access to only essential administrators; enable comprehensive logging of all login attempts and command execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today