EUVD-2026-69459
GHSA-qr97-wv53-ww5f
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Local access and authenticated low-privilege operator required; high complexity for OS-level data access; scope changes to host OS boundary; no integrity or availability impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensitive data which could be used to gain further unauthorized access to the affected system and to other systems it interacts with.
AnalysisAI
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent prerequisites are required: (1) a valid authenticated low-privilege operator account on HPE Fabric Composer - unauthenticated exploitation is excluded by CVSS PR:L; (2) local access to the host running Fabric Composer, specifically via local console or remote shell such as SSH - the CVSS AV:L vector explicitly excludes network-only (remote without shell) exploitation; (3) satisfaction of high attack complexity conditions (CVSS AC:H), indicating specific timing, race, or environmental prerequisites on the host OS that must be met for successful data extraction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.6 accurately reflects a mid-severity, access-constrained finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the specific fixed version and upgrade instructions; no exact patched version number is present in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today