EUVD-2026-116170
GHSA-6mf9-42jc-236w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
ExploitAccess Fabric Composer API
-
ExecutionAbuse privilege escalation flaw
-
ImpactElevate privileges on host
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already have local access to a system running HPE Networking Fabric Composer with a low-privileged authenticated account (CVSS AV:L, PR:L), and to interact with the product's API. The specific API feature, configuration setting, or operation that must be reachable is not described in the available sources. Limiting factors: this cannot be exploited remotely and cannot be exploited by an unauthenticated user - a prior local foothold with at least low privileges is mandatory, which substantially narrows the realistic attacker population to insiders or those who have already compromised a limited account. |
| Impact | This is a moderate-severity local privilege escalation in HPE Networking Fabric Composer, rated CVSS 7.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The signals are internally consistent but point to a bounded, non-urgent threat: the attacker must already have local access and low-level privileges (AV:L, PR:L), so this is a post-compromise escalation rather than an internet-facing entry point. There is no confidentiality impact (C:N) but high integrity and availability impact (I:H/A:H), meaning a successful attack lets an existing low-privileged user tamper with or disrupt the system rather than exfiltrate data. No EPSS score, KEV listing, or PoC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating it should be remediated in the near term but is not an emergency. Net assessment: a legitimate priority for organizations running Fabric Composer on multi-user or shared-access systems, but the local-only vector and authentication requirement make it a lower real-world risk than the 7.1 score alone might suggest. CWE is listed as N/A and the description does not state the underlying flaw mechanism, so the trigger is not described in the available sources. |
| Exploit ScenarioDerived | A user who already holds a low-privileged local account on a system running HPE Networking Fabric Composer interacts with the product's API to perform an action that elevates their privileges on that host. Because the CVSS vector is local and requires authentication (AV:L/PR:L), the attacker needs prior foothold access rather than remote network reach. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local privilege escalation in HPE Networking Fabric Composer allows an attacker who already holds a low-privileged local account to raise their privileges on the affected system through the product's API, compromising integrity and availability (CVSS 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw cannot be reached remotely or without an existing authenticated foothold, so the realistic exposure is limited to insiders or attackers who have already compromised a restricted account on a Composer host. No public exploit code or active exploitation has been identified at time of analysis, and the issue is tracked for remediation within this week's patch cycle.
RemediationAI
No fixed version is stated in the available data, so patch status cannot be confirmed from this record; obtain the vendor's fixed release and version guidance directly from the HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US before making any upgrade decision. Because exploitation requires local access and a low-privileged authenticated account, the practical interim controls are to inventory and trim non-administrative local accounts and API-capable service accounts on Fabric Composer hosts, to restrict interactive logon and API reachability to the smallest set of trusted operators and management networks, and to monitor API activity from low-privileged accounts for privileged operations. Each of these narrows exposure only against attackers who do not already hold such an account, and none of them substitutes for the vendor fix, which the advisory should be treated as the complete remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the API layer of HPE Networking Fabric Composer, a management and orchestration platform for HPE networking fabrics. The weakness class is a privilege escalation permitted by the API (CWE not assigned in the available data): an authenticated low-privileged local user can perform API operations that should require higher rights, resulting in high integrity and availability impact while confidentiality is unaffected. The supplied evidence does not describe the specific API endpoint, parameter, configuration toggle, or code path that enables the elevation, so the exact trigger is not described in the available sources; the CVSS metrics (AC:L, PR:L, UI:N, AV:L) describe the assessed severity and preconditions, not the underlying mechanism. Exploitation is constrained by the requirement for local access plus a valid low-privileged account, and the advisory reference is the HPE support document hpesbnw05172en_us.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local privilege escalation via the API by an already-authenticated low-privileged user gives AV:L/PR:L; no data disclosure (C:N) but full integrity/availability impact (I:H/A:H).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.
Executive ViewAI
HPE Networking Fabric Composer contains a high-severity local privilege escalation flaw (CVE-2026-95752) that could allow an insider with a low-privileged account to gain elevated control over the affected host, undermining system integrity and availability. Leadership should prioritize remediation because the product is central to network fabric management, and successful exploitation could disrupt critical network operations.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local account access, enforcing least privilege, monitoring for privilege escalation attempts, and applying any HPE-provided configuration hardening.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB