Networking Fabric Composer EUVD-2026-116179

Exploitation requires an authenticated administrative account on HPE Networking Fabric Composer (CVSS PR:H) interacting with its API, AND a specific set of enabling preconditions that the description states are 'outside of the attacker's control' - these exact conditions are not enumerated in the available sources. Limiting factors that substantially reduce real-world risk: the attacker must already hold administrative privileges (so this is a persistence/session-retention issue, not initial access), the high attack complexity (AC:H) reflects the dependency on those uncontrolled preconditions being met, and no user interaction is required (UI:N). The precise configuration or deployment mode that triggers the insufficient session expiration is not described in the available sources.

This is a moderate-severity, low-urgency issue, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N, base 5.9) describes a network-reachable flaw that nonetheless requires an already-authenticated administrative account (PR:H) plus a high-complexity set of preconditions (AC:H) that are explicitly 'outside of the attacker's control.' In plain terms, the attacker must already be a privileged admin, so the realistic threat is persistence/retention of access by an insider or a previously-compromised admin credential rather than fresh external compromise. The vuln.today decision label is 'this_month' (routine patching cadence), consistent with the elevated prerequisites. No EPSS score, no CISA KEV listing, and no public exploit are present in the input; absence of these is expected for a newly-disclosed, high-privilege logic flaw and does not by itself lower the already-modest risk. The only provided reference is the HPE vendor advisory (hpesbnw05172en_us). CWE is listed as N/A, but the description (insufficient session expiration → persistent access) corresponds to CWE-613; this is an inference, not vendor-confirmed. Note a signal tension worth flagging: the input Tag 'Information Disclosure' does not match the described mechanism (session expiration / persistent access), so treat that tag with caution. Overall: genuine but bounded risk - prioritize for normal patch cycles, elevate only in environments where admin-credential compromise or malicious insiders are part of the threat model.

An attacker who has (or has stolen) administrative credentials for HPE Networking Fabric Composer authenticates to the API; because sessions do not expire when they should under certain non-attacker-controlled conditions, the attacker's session or token remains valid beyond its intended lifetime, letting them retain administrative access even after the credential should have been invalidated. No public exploit code or PoC reference is present in the provided data. The high attack complexity (AC:H) and administrative privilege requirement (PR:H) make this an insider/post-compromise persistence technique rather than an initial-access vector.