HPE Networking Fabric Composer EUVD-2026-116176

Requires an attacker who already possesses valid low-privilege authenticated access to the API of HPE Networking Fabric Composer (CVSS PR:L); it is not exploitable by an unauthenticated outsider against a default install. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The exact API feature or endpoint that permits the audit record suppression is not described in the available sources. The principal limiting factor is the prerequisite of existing authenticated access, which confines realistic exploitation to malicious insiders or attackers who have already compromised operator-level credentials.

This is a moderate-priority, not an emergency: the input Decision label is 'this_month', there is no CISA KEV listing, no EPSS probability was supplied, and no public exploit or PoC reference is present (the sole reference is the HPE security advisory, not exploit code). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, score 6.5) is internally consistent with the description: network-reachable API, low attack complexity, and crucially PR:L - the attacker must already hold low-privilege authenticated access. The I:H / C:N / A:N split correctly reflects that the only impact is to integrity of audit data, not confidentiality or availability. The real-world significance is narrower than the 6.5 'medium' suggests in isolation: this is an anti-forensics / accountability-defeating weakness most valuable to a malicious insider or to an attacker who has already obtained valid credentials, letting them suppress the audit trail of their other actions. It does not by itself grant access, data theft, or disruption. No signals conflict, but note that EPSS is absent (so statistical exploitation likelihood cannot be stated) and the input 'Authentication Bypass' tag contradicts the description, which is an audit-log bypass by an already-authenticated user.

An attacker who already holds low-privilege credentials for the HPE Networking Fabric Composer API - a rogue insider or someone using stolen/compromised operator credentials - performs actions on the fabric and then invokes the API behavior that fails to record those actions, erasing evidence of their activity. No public exploit code or PoC reference is identified at the time of analysis, and the specific API trigger is not described in the available sources.