EUVD-2026-69429
GHSA-6wmc-9qv9-r53c
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Retaining AV:N/AC:H/PR:N from official vector; adjusting UI to N because API endpoints do not inherently require user interaction without further evidence.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access when combined with other vulnerabilities.
AnalysisAI
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network reachability to the HPE Fabric Composer API endpoint from the attacker's position; (2) a high-complexity condition that the CVSS AC:H metric signals but the description does not specify - likely a race condition, timing dependency, or specific API request structure; (3) user interaction (UI:R per CVSS), which is unusual for an API flaw and implies a user-triggered action (e.g., an authenticated user performing an operation that exposes the response, or a CSRF-like mechanism). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS base score of 3.1 (Low) reflects a genuinely constrained risk profile: high attack complexity (AC:H), user interaction required (UI:R), and only low confidentiality impact (C:L) with no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for patch version details - no specific fixed version is identifiable from the provided input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today