HPE Fabric Composer CVE-2026-95748

Exploitation requires the attacker to hold an adjacent (same logical/physical L2 segment) network position relative to the HPE Networking Fabric Composer management interface (AV:A) - it is not exploitable from arbitrary remote/internet locations. No authentication is required (PR:N) and no user interaction is needed (UI:N). The vector rates high attack complexity (AC:H), but the specific conditions or trigger behind that complexity are not described in the available sources, so the concrete prerequisites beyond network adjacency cannot be confirmed. The chief limiting factors are the adjacency requirement and the high complexity, both of which reduce realistic exploitability despite the unauthenticated nature of the flaw.

This is a moderate-priority issue whose risk is bounded primarily by the attack vector rather than by its impact. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a SQL injection reachable by an unauthenticated attacker (PR:N) but only from an adjacent network position (AV:A), with high attack complexity (AC:H) and full confidentiality, integrity, and availability impact on the database. The vuln.today decision label is 'this_week', indicating meaningful but non-emergency urgency. Signals are largely consistent: no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input, so there is no public exploit identified at time of analysis. The combination of adjacency and high complexity materially lowers real-world exploitability versus a network-reachable, low-complexity flaw of the same impact - this is not a mass-exploitation candidate like an internet-facing unauth RCE. Key data is missing: EPSS probability, KEV status confirmation beyond absence, and CWE classification (listed N/A, though the description and 'SQLi' tag clearly indicate SQL injection / CWE-89). The high complexity (AC:H) is asserted by the vector but the trigger is not described in the available sources, so the precise exploitation requirements cannot be verified.

An attacker already positioned on the same adjacent network segment as the HPE Networking Fabric Composer management interface sends crafted input to a vulnerable, unauthenticated endpoint, injecting SQL that the backend database executes. Because impact is rated C:H/I:H/A:H, successful injection could read, modify, or destroy fabric management data. No public exploit code or PoC is identified in the available data, and the high attack complexity suggests non-trivial conditions must be met.