EUVD-2026-116286
GHSA-2q4m-crc4-4c77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged local access
-
DeliveryInvoke flawed OS file-write operation
-
ExploitOverwrite privileged file or script
-
ExecutionElevated process executes attacker-controlled content
-
ImpactGain elevated/root control of appliance
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires authenticated local access to the HPE Networking Fabric Composer host (CVSS PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated user, and no user interaction is needed (UI:N). The flaw lets a local attacker create or overwrite arbitrary files in the underlying OS with elevated privileges, making it a local privilege-escalation primitive. The precise feature, configuration, or OS operation that triggers the write is not described in the available sources. The main limiting factor is the prerequisite of valid low-privileged local access to the appliance, which confines realistic exploitation to users who have already gained a foothold. |
| Impact | This is a moderately serious local privilege-escalation issue rather than a remotely exploitable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have authenticated local access to the HPE Networking Fabric Composer host, with low complexity and no user interaction, yielding full C:H/I:H/A:H impact because the arbitrary file write executes with elevated privileges on the underlying OS - effectively a path to root/system control. No EPSS score, CISA KEV listing, or POC/exploit reference was supplied, so there is no public evidence of exploitation or exploit code at this time; absence of these signals is not proof of safety but does argue against widespread opportunistic attacks. The vuln.today decision label is 'this_week', consistent with a high-severity but authentication-gated local flaw that should be patched promptly rather than treated as an active-exploitation fire drill. Note a data conflict: the only tag is 'Information Disclosure', which contradicts the description - this is an arbitrary file write / privilege-escalation (integrity) flaw, not an information-disclosure issue; the tag appears mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An attacker who already holds low-privileged authenticated local access to a Fabric Composer appliance abuses the file-write flaw in the underlying operating system to create or overwrite a file that is processed with elevated privileges. By targeting a sensitive location (for example a configuration, script, or binary consumed by a privileged process), the attacker escalates from a limited local account to full control of the system. No public exploit code or POC reference was provided, and the exact trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local privilege escalation in HPE Networking Fabric Composer lets an attacker who already holds low-privileged authenticated access on the host create or overwrite arbitrary files in the underlying operating system with elevated privileges, with high impact on confidentiality, integrity and availability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms the flaw is not remotely reachable and requires valid local credentials, so realistic abuse is confined to users who already have a foothold on the appliance; no user interaction is needed once that access exists. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a post-compromise escalation and persistence primitive rather than an internet-facing emergency; the vulnerability.today decision label places it in the this_week remediation queue.
RemediationAI
The provided data does not identify a fixed version, so obtain the corrected release and the affected-version matrix directly from the HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US (document hpesbnw05172en_us) and apply the vendor-supplied update rather than relying on an inferred version number. Because exploitation is gated on authenticated local access (AV:L, PR:L), the practical interim control is to reduce who can obtain interactive or shell-level access to the Fabric Composer host: restrict local account provisioning to trusted administrators, remove or disable unnecessary OS-level accounts and shared credentials on the appliance, and audit for existing low-privileged local users, accepting that this narrows operational flexibility for support and automation staff. Any compensating measure is partial, since it limits the attacker's foothold requirement rather than the file-write primitive itself, and no public exploit or proof-of-concept is currently documented that would support targeted detection signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the underlying operating system layer of the HPE Networking Fabric Composer appliance rather than in the Fabric Composer application logic itself, per the vendor description, and manifests as an arbitrary file write that the attacker can direct at privileged locations. The assessed vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a locally reachable, low-complexity path that requires low-privileged credentials and no user interaction, with scope unchanged and high impact across confidentiality, integrity and availability - consistent with a local privilege-escalation primitive built on privileged file creation or overwrite. No CWE identifier was supplied, so the precise root-cause class (for example a path-handling, symlink-following or permission-check weakness in an OS-level write operation) cannot be confirmed, and the specific feature, configuration or OS operation that triggers the write is not described in the available sources. Likewise, the appliance's supported deployment modes and any configuration-dependent conditions for exploitation are not detailed in the supplied data, so per-deployment exposure is unverified beyond the local-access prerequisite.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated local attacker (AV:L/PR:L) performs a straightforward file write (AC:L/UI:N) that runs with elevated privileges, giving full C/I/A impact on the host.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges.
Executive ViewAI
HPE Networking Fabric Composer contains a high-severity local privilege escalation flaw that allows an authenticated low-privileged user to gain elevated control over the appliance. While not remotely exploitable, any attacker with existing local access could exploit this to compromise confidentiality, integrity, and availability of the system. Leadership should prioritize remediation to close a post-compromise escalation path that could enable deeper network persistence.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing least privilege on local accounts, monitoring file system changes, and restricting interactive access to the appliance.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB