EUVD-2026-69457
GHSA-9v99-c5q4-vm64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or compromise operator-level credential
-
DeliveryAuthenticate to Fabric Composer API over network
-
ExploitSend crafted API request targeting privileged operation
-
ExecutionBypass authorization check
-
ImpactModify restricted system settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privilege operator-tier account on the HPE Networking Fabric Composer instance and network-level access to the Fabric Composer API (AV:N). No non-default configuration or special deployment mode is indicated - the authorization failure appears to be a baseline API design defect rather than a condition triggered by optional settings. Limiting factors: the operator credential requirement (PR:L) restricts exploitation to insiders, credential-compromise scenarios, or attackers who have separately obtained low-privilege access; and the impact is bounded to modification of 'certain settings' whose full scope is not specified in available data, preventing precise blast-radius assessment. |
| Impact | The CVSS 6.5 score reflects a meaningful integrity risk bounded by the requirement for a valid operator credential (PR:L), which limits exposure relative to the unauthenticated Fabric Composer flaws documented in the same advisory window. No EPSS data is available, and the vulnerability is absent from CISA KEV, so no confirmed active exploitation has been identified. However, context from related HPE Fabric Composer CVEs - including unauthenticated RCE and authentication bypass - raises the concern that an attacker who chains a separately obtained low-privilege credential with this privilege escalation could achieve broader system impact. The description's reference to 'certain settings' is imprecise; the exact blast radius of the unauthorized modifications is not confirmed from available data, making definitive impact assessment uncertain. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege operator credential - through phishing, credential stuffing, or a companion vulnerability such as the authentication bypass documented in related Fabric Composer CVEs - authenticates to the Fabric Composer API over the network and sends crafted API requests to modify system settings restricted to administrator roles. Because AC:L and UI:N apply, no elevated attack sophistication or victim interaction is required beyond possession of the credential. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
RemediationAI
The primary fix is to apply the patch or upgrade identified in HPE Security Bulletin hpesbnw05133en_us, available at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US. An exact patched version number is not confirmed from the data provided and must be verified directly from the advisory. As compensating controls pending patch deployment, administrators should audit and minimize the number of accounts provisioned with operator-level API access, enforce strong and unique credentials for all Fabric Composer API accounts, and restrict API endpoint reachability to trusted management networks using firewall rules or network segmentation - noting that segmentation reduces exposure but does not eliminate risk from insider or already-compromised accounts. Enabling API access logging and alerting on unexpected setting changes by operator-tier accounts provides a detection layer without operational disruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is an orchestration and management platform for HPE network fabrics, commonly deployed in enterprise data center environments. The vulnerability resides in the product's API layer, which fails to enforce adequate authorization boundaries between operator and administrator privilege tiers - operator-level API callers can invoke operations that alter system configuration state reserved for higher-privilege roles. CWE is listed as N/A in the input, but the root cause pattern corresponds to CWE-269 (Improper Privilege Management) or CWE-285 (Improper Authorization). The CPE string cpe:2.3:a:hewlett_packard_enterprise_(hpe):fabric_composer:*:*:*:*:*:*:*:* carries a wildcard version field, indicating no known version-specific constraint - all deployed versions appear affected.
Know when Fabric Composer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Operator credential required (PR:L); API reachable over network (AV:N); impact is integrity-only via unauthorized settings modification, no confidentiality or availability effect.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Exploit-DB