HPE Fabric Composer EUVD-2026-116177

Exploitation requires a valid authenticated account with low privileges on HPE Networking Fabric Composer (PR:L) and access to its management API over the network (AV:N). Additionally, the vendor states that 'certain preconditions outside of the attacker's control' must be met, which corresponds to the AC:H rating - the attacker cannot force these conditions, so success is opportunistic. The precise nature of these preconditions is not described in the available sources. Limiting factors: no unauthenticated path, no exploitation against default state is claimed, and the attacker-uncontrolled preconditions reduce reliability and realistic exploitability.

This is a moderate-priority privilege escalation issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L, base 6.4) and the description agree on the mechanism-relevant facts: an already-authenticated low-privilege user abuses the Fabric Composer API to gain elevated privileges. The AC:H rating is explicitly justified by the description's statement that 'certain preconditions outside of the attacker's control' must be met, so exploitation is not reliably repeatable at will. No EPSS score, no CISA KEV listing, and no public exploit or PoC reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', consistent with a real but non-urgent fix timeline rather than act_now/emergency. Signals are internally consistent - no conflict between the network vector and the authenticated, precondition-gated mechanism. The main limiting factors are the required valid low-privilege account and the attacker-uncontrolled preconditions, which together argue for scheduled patching rather than crisis response.

An attacker who already holds a valid low-privilege account on HPE Networking Fabric Composer sends crafted requests to the management API and, when certain environmental preconditions happen to be satisfied, escalates to higher privileges on the system. Because those preconditions are outside the attacker's control, exploitation is opportunistic rather than reliably repeatable. No public exploit or PoC reference was provided in the available data.