Fabric Composer EUVD-2026-116181

Exploitation requires the attacker to be on the same adjacent/logically-adjacent network (AV:A) as a client communicating with the HPE Networking Fabric Composer API, and depends on the API's improper certificate validation permitting a forged or attacker-substituted certificate to be accepted. A legitimate client interaction is required to complete the attack (UI:R), so it is not a silent, fully automated remote compromise. Limiting factors that reduce realistic risk: no Internet-facing/remote vector, dependence on a man-in-the-middle position within the management network, required user/client interaction, and impact limited to disclosure of sensitive information (no integrity or availability impact). No special product feature toggle is named in the available sources beyond the API's certificate handling.

This is a moderate-severity information-disclosure issue (CVSS 5.7) whose real-world priority is tempered by several limiting signals that align rather than conflict. The CVSS vector is self-consistent with the description: AV:A means the attacker must be adjacent (same logical L2/management network segment), not remote across the Internet; PR:N confirms no authentication is needed; UI:R means a legitimate user/client interaction is required to complete the attack; and impact is confined to confidentiality (C:H/I:N/A:N), matching 'access sensitive information.' There is no CISA KEV listing, no public PoC referenced, and no EPSS score supplied, so there is no evidence of active or imminent mass exploitation. The vuln.today decision label is 'this_month' (a routine remediation cadence, not act_now/emergency), consistent with the absence of exploitation signals. The practical blockers - adjacent-network positioning plus required user interaction (characteristic of a certificate-validation/MITM flaw) - mean this is a targeted, conditions-dependent risk rather than a broadly automatable one. Missing data to note explicitly: no EPSS probability, no KEV/PoC status, and CWE is listed as N/A though the description clearly describes improper certificate validation.

An attacker with a foothold on the same adjacent network as a Fabric Composer management client intercepts TLS traffic to the Fabric Composer API and presents a forged or substituted certificate. Because the API does not properly validate certificates, the client proceeds with the connection when a user or automated client initiates it (UI:R), allowing the attacker to observe sensitive information in transit. No public exploit identified at time of analysis; exploitation requires adjacent positioning and does not grant code execution or data modification.