HPE Fabric Composer CVE-2026-95757

Exploitation requires the attacker to already have local, low-privileged access to the HPE Networking Fabric Composer system (CVSS AV:L, PR:L) - there is no remote or unauthenticated path in the supplied data. The impact is further gated by configuration: the arbitrary file write targets remote servers that have been configured on the affected system, so a Fabric Composer instance with no such remote servers configured has a reduced blast radius. The available sources do not describe the internal mechanism of the authentication/authorization bypass or name a specific feature toggle, so the exact triggering condition beyond 'local low-privileged access to the affected API' is not described in the available sources. Limiting factors for defenders: no network vector, a required pre-existing local account, and dependence on remote servers being configured.

This is a moderate-priority, not emergency, issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attacker who already holds low-privilege access to the affected HPE Networking Fabric Composer system - not a remotely reachable flaw - which materially constrains who can exploit it. The scope change (S:C) with I:H/C:N/A:N reflects that the real damage lands on OTHER systems: the attacker abuses the Fabric Composer API to write arbitrary files to remote servers configured on the appliance, so the integrity impact is lateral rather than local. No EPSS score, CISA KEV listing, or PoC reference was supplied in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a real-but-bounded issue rather than an act-now emergency. The chief conflict to flag: the description calls this an 'authentication bypass' and names an 'API,' yet the vector requires PR:L (already-authenticated low privileges) and AV:L (local) - the bypass is of an internal authorization control reachable by a local low-privileged user, not a pre-auth network bypass. Treat it as a privilege/trust-boundary escalation available to existing local users, and verify the exact access prerequisite with HPE's advisory.

A local user with low privileges on an HPE Networking Fabric Composer instance invokes the affected API to bypass its authorization check and write attacker-controlled files to remote servers that the appliance is configured to manage. By placing files on those downstream servers, the attacker can tamper with managed-host configuration or state. No public exploit code or PoC reference was provided in the input.