EUVD-2026-116188
GHSA-j2pf-79hj-ghw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privileged credentials
-
ExploitAuthenticate to Fabric Composer API
-
ExecutionQuery vulnerable API endpoint
-
ImpactReceive unauthorized limited system information
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already be authenticated to HPE Networking Fabric Composer with at least low-level privileges (CVSS PR:L); it is not exploitable by anonymous/unauthenticated remote users. The attacker then reaches a specific (unnamed in the available sources) API endpoint over the network (AV:N) with low attack complexity and no user interaction. The impact is limited to disclosure of limited system information (C:L), with no integrity or availability effect. The primary limiting factor is the credential requirement; the exact endpoint, required privilege role, and any non-default configuration dependency are not described in the available sources. |
| Impact | This is a low-to-moderate priority issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) describes a network-reachable but authenticated flaw (PR:L) with low complexity, yielding only limited confidentiality impact and no integrity or availability impact. The vuln.today decision label is 'this_month', consistent with a non-critical confidentiality-only bug. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no signal of active or imminent exploitation. The dominant limiting factor is the authentication requirement (PR:L): an attacker must already hold valid low-privileged credentials on the Fabric Composer, which substantially narrows the realistic threat to insiders or post-compromise credential reuse. No signals conflict here; all available data (medium CVSS, no EPSS/KEV/PoC, 'this_month' label) point consistently to a real-but-low-urgency information disclosure. Missing data to note: EPSS probability, CWE classification, and affected/fixed version details are not provided in the input. |
| Exploit ScenarioDerived | An authenticated low-privileged user (or an attacker who has obtained valid Fabric Composer credentials) sends a request to a specific API endpoint and receives limited system information it should not have been authorized to see. The disclosed data could aid reconnaissance for follow-on attacks. No public exploit or PoC is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Authenticated information disclosure in HPE Networking Fabric Composer lets a remote attacker with low-level credentials query a specific API endpoint and obtain limited details about the affected system (CVSS 4.3, PR:L, C:L). The issue is low-to-moderate priority: it requires prior authentication, has no integrity or availability impact, and no public exploit identified at time of analysis. The available advisory data does not name the vulnerable endpoint, the exact required role, or a fixed version.
RemediationAI
No fixed version is identified in the available data, so the HPE support document (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US) should be treated as the authoritative source for the vendor's patched release and any official workaround. Because the vulnerable API endpoint and required role are not named in the sources, endpoint-specific mitigations cannot be prescribed; practical exposure reduction is to restrict network access to the Fabric Composer API to trusted management networks and to review which accounts hold API privileges, while recognizing that these controls reduce exposure but do not remediate the underlying flaw. Authentication is a prerequisite (PR:L), so eliminating low-privilege API accounts where possible also limits the attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is a network fabric management and orchestration platform whose API is reachable over the network. The disclosed issue is an information-disclosure flaw in an API endpoint: per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), an attacker who already holds low-privileged credentials can reach the endpoint remotely with low complexity and no user interaction, and can read limited system information. No CWE is assigned in the supplied data, and the sources do not describe the underlying coding error, the endpoint path, the exact privilege role, or whether any non-default configuration is required, so the trigger and root cause are not described in the available sources. Scope is unchanged and only confidentiality is affected.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable API (AV:N/AC:L) requires valid low-privileged credentials (PR:L) and no user interaction; only limited information is disclosed (C:L), with no integrity or availability impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB