EUVD-2026-69443
GHSA-38wc-m42p-9wqf
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-accessible and unauthenticated; AC:H and UI:R reflect external preconditions and required user interaction per description; full CIA impact on compromised host, scope unchanged.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.
AnalysisAI
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two distinct prerequisites that work in conjunction: (1) a high-complexity precondition outside the attacker's direct control (AC:H) must be satisfied - the HPE advisory does not publicly specify what state or condition this is, but it is not something an attacker can reliably force or manufacture independently; and (2) some form of user interaction (UI:R) must occur, suggesting a privileged user of the Fabric Composer system must take an action, such as accessing a malicious link or triggering a specific application workflow, for the exploit to complete. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 captures an important tension: despite full C:H/I:H/A:H impact (complete host compromise), two friction factors substantially reduce real-world exploitability - AC:H indicates preconditions outside the attacker's direct control, and UI:R requires some form of user interaction to complete the exploit chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE Security Bulletin hpesbnw05133en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the vendor-released patch and upgrade instructions; no specific fixed version was confirmed in the data available for independent verification. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HPE Networking Fabric Composer deployments, restrict network access to the management interface from trusted sources only, and verify comprehensive audit logging is enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today