Fabric Composer CVE-2026-95749

The core prerequisite is the product's missing integrity verification: Fabric Composer accepts an artifact without properly validating its authenticity/integrity, which is what enables code execution. Exploitation is LIMITED by two factors stated in the CVSS vector: AC:H means success depends on a specific condition the attacker does not fully control, and UI:R means a legitimate user must perform an action for the attack to complete - so this is not a fully automatable, drive-by remote exploit. Exploitation is unauthenticated (PR:N) and network-reachable (AV:N), meaning no credentials are needed, but the exact feature, protocol, or workflow that skips integrity checking is not described in the available sources - confirm the specific trigger and affected configuration in HPE advisory hpesbnw05172en.

Signals are mixed and point to a credible-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) describes a network-reachable, unauthenticated flaw, but two metrics materially dampen real-world risk: AC:H indicates the attack depends on conditions outside the attacker's control, and UI:R requires a victim to take an action. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC or exploit reference is present, so there is no public evidence of exploitation or exploit tooling. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious code-execution bug that is non-trivial to trigger rather than a mass-exploitable zero-day. Missing data to note explicitly: CWE is N/A, EPSS is absent (absence is not a low score - it is simply unknown), and the CVSS vector does not describe the mechanism, so WHY AC:H and UI:R apply is not stated in the available sources - verify the exact trigger with the HPE advisory. Bottom line: a high-severity RCE worth patching on a normal priority cycle, not a drop-everything event, absent evidence of active exploitation.

Because the product performs missing integrity verification, a remote unauthenticated attacker crafts a malicious artifact (e.g. a tampered update, image, or payload the system fails to validate) and gets it accepted by Fabric Composer, leading to arbitrary code execution. The CVSS vector's AC:H and UI:R imply the attacker must satisfy a non-trivial condition and a legitimate user must perform an action (such as initiating or approving an operation) for the chain to succeed. No public exploit or POC is identified at time of analysis.