HPE Fabric Composer EUVD-2026-116178

Exploitation requires an authenticated low-privilege foothold against HPE Networking Fabric Composer (PR:L), so it is not remote-unauthenticated. The flaw is improper certificate validation, meaning the product fails to properly verify a certificate and thereby exposes sensitive information; the exact feature, protocol endpoint, or configuration that triggers the weakness is not described in the available sources. Exploitation is further limited by high attack complexity (AC:H in the supplied vector), indicating that conditions beyond the attacker's direct control must hold, though the evidence does not specify what those conditions are. Impact is confined to confidentiality disclosure with only limited integrity effect and no availability impact.

This is a moderate-severity information-disclosure issue (CVSS 5.9) that does not rise to an urgent priority on the available signals. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N) indicates a network-reachable flaw that nonetheless requires existing low-privilege authentication (PR:L) and high attack complexity (AC:H), which materially constrains real-world exploitability. There is no CISA KEV listing, no EPSS score supplied, and no public proof-of-concept in the provided data, so exploitation is neither confirmed nor demonstrated - the status is no public exploit identified at time of analysis. The vuln.today decision label is this_month, consistent with a real but non-emergency item to schedule into routine patching rather than treat as drop-everything. The high confidentiality impact (C:H) is the main driver of the score, but it is gated behind authentication plus the AC:H condition; the evidence does not describe what makes complexity high, so that gating should not be over-interpreted. Note the signal set is thin: no EPSS, no KEV, no CWE, and only a single vendor reference, so confidence rests almost entirely on the vendor advisory and the CVSS vector.

An attacker who already holds a low-privilege authenticated account on, or network access to, an HPE Networking Fabric Composer deployment leverages the improper certificate validation flaw to obtain sensitive information that should have been protected by proper certificate checking. The high attack complexity (AC:H) implies conditions outside the attacker's sole control must be met, and the specific trigger is not described in the available sources. No public exploit code has been identified.