Fabric Composer EUVD-2026-116160

Exploitation requires the attacker to already have local, low-privileged access to the operating system underlying the HPE Networking Fabric Composer appliance (CVSS PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated user and needs no user interaction (UI:N). The flaw resides in the underlying OS of the appliance, so exposure is limited to environments where untrusted or lower-tier users can obtain account/shell access on the Fabric Composer host. The specific OS feature, configuration, or trigger is not described in the available sources.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity privilege escalation requiring the attacker to already be an authenticated low-privileged user (PR:L), yielding full confidentiality, integrity and availability impact confined to the single affected system (S:U). vuln.today assigns a 'this_week' priority - elevated but below act_now/emergency. No CISA KEV listing, no EPSS score, and no PoC or exploit reference appear in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'. Practical risk is gated by the local-access and low-privilege prerequisites: this is not a remotely exploitable, internet-scannable flaw but a post-compromise or insider escalation primitive, most relevant where untrusted or lower-tier users already have a foothold on the appliance OS. Treat it as a meaningful second-stage risk rather than an emergency, consistent with the 'this_week' label.

An attacker who already holds a low-privileged local account or foothold on the HPE Networking Fabric Composer appliance operating system leverages a flaw in the underlying OS to elevate to administrative/root privileges, gaining full control of the fabric management system. No public exploit code is identified in the available data, and the specific trigger is not described in the sources.