HPE Networking Fabric Composer EUVD-2026-116184

Exploitation requires network reachability to the HPE Networking Fabric Composer API; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, special configuration, or user interaction is stated as required, so default deployments with a network-accessible API are exposed. The principal limiting factor is network exposure of the management interface: Fabric Composer is a data-center fabric management tool normally placed on a restricted management network, so segmentation that keeps the API off attacker-reachable networks materially reduces real-world risk. The impact is bounded to confidentiality (C:L) - the flaw discloses sensitive information but, per the vector, does not alter data or affect availability. The exact data exposed and the specific trigger are not described in the available sources.

This is a moderate-severity information disclosure flaw (CVSS 5.3) in the API of HPE Networking Fabric Composer. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity issue requiring no privileges or user interaction, with limited confidentiality impact only (C:L/I:N/A:N) - consistent with leakage of some sensitive data rather than full compromise. The vuln.today priority is 'this_month' (not act_now/emergency), aligning with a real-but-not-urgent issue. No EPSS score was supplied, so exploitation probability cannot be quantified. There is no CISA KEV listing and no PoC or exploit reference in the provided data, so there is no evidence of active exploitation or public exploit code. The signals are internally consistent: a network-reachable unauthenticated leak that is genuinely exploitable but bounded to partial confidentiality impact, making it a credible patch-this-cycle item rather than a drop-everything emergency. The practical ceiling is that the attacker gains information, not code execution or data modification; the real risk depends on how sensitive the exposed data is, which the description does not specify.

A remote attacker with network reachability to the Fabric Composer management interface sends crafted requests to the affected API endpoint and receives sensitive system information back without needing credentials. No public exploit code or PoC reference is provided in the available data. Because the interface is a data-center fabric manager, exposure is most dangerous where the management API is reachable beyond a trusted management network.