HPE Fabric Composer CVE-2026-95765

Exploitation targets the web-based management interface of HPE Networking Fabric Composer and, per the CVSS vector, requires user interaction (UI:R) - meaning a legitimate user of the interface must perform some action for disclosure to occur; this is the primary limiting factor, since the flaw is not a fully autonomous remote read. No authentication is required (PR:N), and the vector is network-reachable with low complexity (AV:N/AC:L). The specific product feature, request, or configuration that triggers the disclosure is not described in the available sources. Realistic risk is bounded by the need to reach the management interface (which should be network-segmented/restricted in sound deployments) and by the required user interaction.

This is a moderate-severity information disclosure flaw (CVSS 5.4) in the web-based management interface of HPE Networking Fabric Composer, reported by the vendor's own PSIRT (security-alert@hpe.com). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity, unauthenticated exploitation, but the UI:R metric means success depends on an action by a legitimate user - which materially reduces the likelihood of opportunistic mass exploitation. No EPSS score, CISA KEV listing, or proof-of-concept reference is present in the supplied data, and there is no public exploit identified at time of analysis; the vuln.today decision label is 'this_month' rather than act_now or emergency, consistent with a real-but-not-urgent remediation priority. One internal inconsistency is worth flagging for verification: the description characterizes the issue strictly as sensitive information disclosure (a confidentiality impact), yet the supplied CVSS vector also asserts I:L (integrity impact) - the integrity component is not supported by the description and should be confirmed with HPE's advisory. Overall this reads as a genuine but non-critical issue to patch in the normal monthly cycle, not a high-CVSS-but-illusory finding nor an active-exploitation emergency.

A remote attacker who can reach the Fabric Composer management interface crafts a request or link that, when acted upon by a user of the interface (UI:R), causes the application to return sensitive information to the attacker without requiring authentication. No proof-of-concept or exploit code is referenced in the available data, so the exact trigger mechanism is not described in the supplied sources.