HPE Fabric Composer CVE-2026-95777

Exploitation requires an existing low-privileged authenticated session on the HPE Networking Fabric Composer management interface (PR:L), so it is not available to fully unauthenticated attackers. The available description does not name the exact feature, endpoint, or configuration that exposes the sensitive data, and the specific trigger is not described in the available sources. Limiting factors confirmed from the data: valid low-privilege credentials are needed, high attack complexity (AC:H) implies conditions not fully under the attacker's control, and impact is confined to disclosure of 'certain sensitive information' (C:L) with no integrity or availability effect.

This is a low-severity issue (CVSS 3.1 base 3.1) that the available signals consistently rank as low real-world priority rather than a high-CVSS-but-low-risk mismatch. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable flaw but one gated by high attack complexity (AC:H) and requiring low-privileged authentication (PR:L), with only limited confidentiality impact (C:L) and no integrity or availability impact. The vuln.today decision label is 'monitor', which aligns with - and is not contradicted by - the other signals. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the supplied data, so there is no indication of active exploitation or published exploit code. The signals are mutually consistent: a low-impact, authenticated, high-complexity information disclosure with no exploitation evidence. The main missing data points are EPSS probability and any independent confirmation of affected versions; the single reference is an HPE security bulletin that was not retrieved, so fix details are not verified here.

A low-privileged but authenticated user of the HPE Networking Fabric Composer management interface leverages the flaw to read certain sensitive information stored on the system that their privilege level should not expose. Because the CVSS vector specifies high attack complexity (AC:H), success likely depends on conditions outside the attacker's full control, so exploitation is not straightforward. No public exploit identified at time of analysis.