HPE Networking Fabric Composer EUVD-2026-116190

Exploitation requires the attacker to already have low-privileged local access (PR:L, AV:L) to a host running HPE Networking Fabric Composer, and to share that host with other workloads - the impact (S:C) is a partial denial-of-service against those co-located workloads, not remote-reachable service disruption. Limiting factors: no remote/network vector, no path to confidentiality or integrity compromise (C:N/I:N), only partial/low availability impact (A:L), and a pre-existing authenticated foothold on the host is mandatory. The specific product feature, protocol, or configuration that triggers the resource exhaustion is not described in the available sources.

This is a low-priority, low-severity issue (CVSS 3.8), and the available signals are internally consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) describes a locally-exploitable flaw requiring low privileges, with no confidentiality or integrity impact and only a low availability impact; the scope change (S:C) reflects that the partial denial-of-service spills over to other workloads sharing the same host rather than affecting only HPE Networking Fabric Composer itself. The vuln.today Decision label is 'monitor,' which aligns with the low score. No EPSS score, CISA KEV listing, POC reference, or SSVC decision framework data was supplied, so exploitation probability and automatability cannot be quantified from the input - but given the local attack vector, authentication requirement, and availability-only impact, there is no indication this is a high-risk-despite-low-CVSS case. One metadata inconsistency is worth noting: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (C:N) and the description (a denial-of-service condition). Treat this as a routine patch-on-cycle item, not an emergency.

A low-privileged user already able to run workloads on a host that also runs HPE Networking Fabric Composer abuses the vulnerability to consume or exhaust a shared resource, degrading availability for other workloads co-located on that host. Because the attack vector is local and requires existing low-level privileges (PR:L), the attacker must first have a foothold on the host; the specific trigger mechanism is not described in the available sources. No public exploit identified at time of analysis.