EUVD-2026-116191
GHSA-vq2j-6vxw-gmr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Fabric Composer over network
-
ExploitTrigger disclosure flaw (high complexity)
-
ImpactObtain sensitive information
Vulnerability Assessment
| Exploitation Conditions | The HPE advisory abstract states only that an unauthenticated remote attacker could obtain sensitive information; the specific feature, protocol, or configuration that must be present to trigger disclosure is not described in the available sources. The limiting factor is the high attack complexity (AC:H), which implies conditions outside the attacker's direct control must be met for successful exploitation; impact is confined to confidentiality (C:L) with no integrity or availability effect. Exact affected/fixed versions and any deployment-mode dependencies are not in the supplied data and should be verified against HPE advisory hpesbnw05172en_us. |
| Impact | This is a low-severity issue (CVSS 3.7) that the vuln.today decision framework rates 'monitor' - not an urgent priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, unauthenticated flaw, but high attack complexity (AC:H) and limited confidentiality-only impact (C:L, with no integrity or availability effect) substantially constrain real-world risk. No EPSS score, KEV listing, or PoC/exploit reference was supplied, so there is no signal of active exploitation or public exploit code. Signals are internally consistent: a low CVSS combined with a 'monitor' decision and the absence of any exploitation indicators all point to a genuinely low-priority, information-disclosure weakness rather than a high-CVSS-but-overrated finding. The main missing data is the specific mechanism and the exact affected/fixed versions, which are only in the HPE advisory, not in the supplied text. |
| Exploit ScenarioDerived | A remote unauthenticated attacker interacts with a network-exposed HPE Networking Fabric Composer instance and, under the specific conditions that trigger the flaw (high attack complexity), induces the system to return sensitive information it should not expose. The disclosed data could aid reconnaissance of the fabric management environment. No public exploit code or PoC reference was provided in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Low-severity information disclosure in HPE Networking Fabric Composer allows remote, unauthenticated attackers to obtain sensitive information from the affected system, but only under conditions that include a high attack complexity per CVSS (AC:H), meaning exploitation depends on circumstances outside the attacker's direct control. Impact is limited to confidentiality (C:L) with no integrity or availability effect, yielding a CVSS 3.1 score of 3.7. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vuln.today decision framework rates this 'monitor', so it is not an urgent priority.
RemediationAI
No vendor-released patch version is specified in the supplied data; the only reference is the HPE advisory hpesbnw05172en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US), which should be consulted for the exact fixed release and any listed affected versions before scheduling upgrades. Because the trigger conditions are not described in the available sources, the supplied data does not identify specific configuration workarounds; the practical interim step is to restrict network access to the Fabric Composer management interface to trusted administrative networks and monitor it for unexpected information exposure, weighing that against reduced administrative reachability. Track the advisory for updated version guidance and re-prioritize if the rate of exploitation or exposure changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is a fabric management and orchestration platform for HPE networking environments; the specific feature, protocol, or configuration necessary to trigger the disclosure is not described in the available sources, and no CWE mapping was supplied, so the root-cause class (for example, over-exposed API response, verbose error output, or misconfigured endpoint) cannot be confirmed. The CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable flaw requiring no privileges and no user interaction, with high attack complexity representing conditions outside the attacker's direct control and a confidentiality-only, low-impact outcome; the assessed severity is 3.7. Version ranges, affected deployment modes, and any configuration prerequisites are not present in the supplied data and should be verified against HPE advisory hpesbnw05172en_us.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Advisory confirms unauthenticated remote disclosure (AV:N/PR:N/UI:N); AC:H reflects non-trivial trigger conditions; impact is confidentiality-only and limited (C:L, I/A:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB