HPE Fabric Composer EUVD-2026-116186

Exploitation requires network reachability to the HPE Networking Fabric Composer API and the ability to send API requests whose recorded client address the service does not validate or bind to the true connection source. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication (PR:N) and no user interaction are needed, and complexity is low. The exact feature or header the attacker manipulates to set the spoofed address is not described in the available sources. Limiting factors: impact is confined to integrity of audit-record client-address data (C:N/A:N), so this neither exposes data nor disrupts service; the attacker must be able to reach the management API, which in well-segmented deployments is typically on a restricted management network rather than the open internet, materially reducing exposure.

This is a moderate-severity, limited-integrity issue, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates network-reachable, low-complexity, unauthenticated access, but the only impact is a LOW integrity effect - specifically the ability to falsify the client address recorded in audit records; there is no confidentiality (C:N) or availability (A:N) impact, and no code execution or data access. No EPSS score, CISA KEV listing, or SSVC exploitation/automatable/technical-impact values were supplied in the input, so quantitative exploitation-likelihood signals are absent; the only priority signal provided is the vuln.today 'this_month' decision label, which is consistent with a non-critical, schedule-the-patch item rather than act_now/emergency. There is no public exploit identified at time of analysis. The realistic risk is that an attacker can undermine the integrity and forensic value of audit logs - spoofing the source address to frustrate attribution, hide the true origin of actions, or implicate another host - rather than directly compromising data or systems. This is a meaningful concern for environments that rely on Fabric Composer audit records for accountability and incident response, but on its own it is a secondary/log-integrity weakness, not a widespread-compromise threat. Note a labeling conflict: the input Tag says 'Information Disclosure', yet the CVSS vector (C:N, I:L) and the description describe an integrity/audit-spoofing flaw, not disclosure - the tag appears mislabeled and should not drive triage.

A remote, unauthenticated attacker sends crafted requests to the HPE Networking Fabric Composer API in a way that causes the service to record a falsified client/source address in its audit log entries. The attacker thereby performs API-observable actions while making the audit trail attribute them to a different or spoofed address, degrading forensic accountability. No public exploit code was identified in the provided sources, and the exact technical trigger is not described in the available sources.