HPE Fabric Composer EUVD-2026-116187

Exploitation requires an authenticated low-privileged user with LOCAL access to the HPE Networking Fabric Composer appliance (CVSS PR:L, AV:L) - remote or unauthenticated exploitation is not possible. The HPE description further states that 'certain preconditions outside of the attacker's control' must be met, which is the explicit limiting factor and is reflected in AC:H; the attacker cannot force or control these conditions, so exploitation is opportunistic rather than reliable. The specific feature, configuration setting, or system state constituting those preconditions is not described in the available sources. No user interaction beyond the attacker's own actions is needed (UI:N). Impact is confined to disclosure of sensitive information from the underlying operating system.

This is a moderate-severity, low-priority issue rather than an urgent one, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7) describes a local-only vulnerability requiring an already-authenticated low-privileged account, with high attack complexity because the description explicitly states that 'certain preconditions outside of the attacker's control' must be met. Impact is limited to confidentiality (C:H), with no integrity or availability effect. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with a real but non-emergency fix cadence. In short, this is a legitimate confidentiality flaw but not a high-real-risk, remotely-weaponizable issue; the combination of local vector, required prior authentication, and attacker-uncontrolled preconditions substantially limits practical exploitation. Note: no EPSS value was provided, so exploitation-probability cannot be quantified from the available data.

An attacker who already holds a low-privileged local account on an HPE Networking Fabric Composer appliance waits for or encounters a specific system state (a precondition outside their control) under which sensitive information becomes readable from the underlying operating system. When that condition is present, the user reads data they should not be able to access. No public exploit code is identified for this issue.