HPE Fabric Composer CVE-2026-95753

Exploitation requires an authenticated session on HPE Networking Fabric Composer with at least low privileges and network reachability to its management API; the flaw is a broken authorization / privilege-escalation condition in that API that lets such a user read network traffic from switches managed by Fabric Composer. The specific API endpoint, request, or trigger mechanism is not described in the available sources. Limiting factors that reduce real-world risk: a valid low-privilege account is mandatory (not anonymous/remote-unauthenticated), the target is a specialized data-center fabric orchestration product rather than broadly internet-exposed software, and the impact is confined to traffic disclosure (confidentiality) with only limited integrity and no availability effect.

This is a moderate-severity, authenticated privilege-escalation flaw in the HPE Networking Fabric Composer API, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The vector indicates network-reachable exploitation at low attack complexity, but it explicitly requires existing low-level privileges (PR:L), so this is an authenticated attack, not a remote-unauthenticated one. The dominant impact is confidentiality (C:H - disclosure of network traffic from managed switches) with only limited integrity impact (I:L) and no availability impact (A:N). No EPSS score, CISA KEV listing, or public exploit was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world risk is therefore bounded by the need for a valid Fabric Composer account and the relatively specialized deployment of the product. The vuln.today decision label is 'this_week', consistent with a serious but non-emergency issue - a genuine priority for organizations running Fabric Composer in sensitive fabrics, rather than a mass-exploitation threat. Key data gaps: EPSS, KEV, and POC status are all absent (absence is not evidence of low risk, only of missing signals), and the exact fixed version is not included in the provided data (it is expected in the referenced HPE bulletin hpesbnw05172en_us).

An attacker who already holds a low-privilege account on HPE Networking Fabric Composer sends crafted requests to the management API that improperly grant elevated access. Because the API fails to properly enforce authorization, the attacker reads network traffic data from switches managed by Fabric Composer, exposing sensitive flows they should not be able to see. The attack is network-reachable with low complexity but requires valid authenticated access, and no public exploit was identified at time of analysis.