HPE Fabric Composer CVE-2026-95741

Exploitation requires a valid low-privileged authenticated account on the HPE Networking Fabric Composer API (PR:L) and user interaction (UI:R) to complete the attack. The root cause is a missing integrity verification check in the product's API, which allows a request/data flow whose authenticity or integrity is not validated to be used for privilege elevation; the exact API operation, data object, or feature that lacks the check is not described in the available sources. Limiting factors that reduce realistic risk: the attacker cannot be fully unauthenticated (an existing low-privilege account is mandatory), a separate user interaction must occur, and the product's deployment footprint is narrow (HPE/Aruba fabric-management environments only).

The CVSS 3.1 base score of 8.0 (High) is driven by a network attack vector (AV:N), low attack complexity (AC:L), and full High impact to confidentiality, integrity, and availability - but two metrics materially temper real-world ease of exploitation: the attacker must already hold a low-privileged authenticated account (PR:L) and the attack requires user interaction (UI:R). The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency triage posture rather than act_now or emergency. No EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept or exploit reference is present in the input - only the HPE vendor advisory. These signals together describe a genuine privilege-escalation issue worth prioritized patching, not a mass-exploitation event: there is no confirmed active exploitation and no evidence of weaponization. The limiting authentication and user-interaction requirements, combined with the relatively narrow deployment footprint of the affected product, suggest the practical risk is moderate and most relevant to environments where lower-trust operators already have API access. Note one data-quality mismatch: the single 'Information Disclosure' tag does not match the described impact (elevation of privilege via missing integrity verification), though the C:H metric does imply some confidentiality exposure.

A low-privileged but authenticated user of HPE Networking Fabric Composer abuses an API operation that fails to verify the integrity of submitted data, and - in combination with a required user interaction (UI:R) - leverages this to elevate their privileges on the system. No public exploit code or PoC reference is identified in the available data, so exploitation would currently require independent development against the specific API flaw. Success would give the attacker elevated (likely administrative) control over the fabric management plane.