HPE Fabric Composer CVE-2026-95766

Exploitation requires a valid authenticated account with low privileges (PR:L) on HPE Networking Fabric Composer that is reachable over the network; no user interaction is needed (UI:N). The CVSS vector marks attack complexity as high (AC:H), indicating a non-trivial or conditional trigger, but the available sources do not describe the specific feature, protocol, configuration, or state required to disclose the sensitive information. Limiting factors for defenders: an attacker must first obtain network access to the management plane and valid low-privilege credentials, and the high complexity suggests the condition is not reliably reproducible from the data provided.

This is a moderate, not emergency, priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.3) describes a network-reachable but high-complexity flaw that an authenticated low-privileged user can leverage to read sensitive information, with no integrity or availability impact. The vuln.today decision label is 'this_month', consistent with a non-critical but worth-remediating issue rather than act_now/emergency. There is no KEV listing (not confirmed actively exploited), no EPSS probability supplied, and no PoC or exploit reference in the input, so exploitation pressure appears low based on available signals. The main mitigating factors are the required low-privilege authentication (PR:L) and the high attack complexity (AC:H); the available sources do not state what makes complexity high, so that condition cannot be characterized further. Note that no EPSS score and no CWE were provided, so probabilistic exploitation likelihood and the precise weakness class are unknown and should be verified against the HPE advisory.

An attacker who already holds a low-privileged authenticated account on HPE Networking Fabric Composer sends crafted requests over the network to the management interface and retrieves sensitive information they should not be able to view. No user interaction is required, but the CVSS vector indicates high attack complexity, so exploitation is not trivially repeatable; the specific trigger is not described in the available sources. No public exploit was identified at time of analysis.