HPE Networking Fabric Composer EUVD-2026-116192

Exploitation requires the attacker to already hold a low-privileged local account on the operating system underlying HPE Networking Fabric Composer (AV:L, PR:L); there is no remote or unauthenticated path. The available advisory does not name the exact file, service, or configuration setting that exposes the readable files, so the precise trigger is not described in the available sources. Limiting factors that reduce realistic risk: local-only access, a pre-existing authenticated foothold, and impact confined to reading certain files (C:L) with no integrity or availability effect.

This is a low-severity, low-priority issue and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning an attacker must already have local, low-privileged access to the underlying operating system and can only read certain files with limited confidentiality impact and no integrity or availability impact. The vuln.today decision label is 'monitor,' which aligns with the low CVSS. There is no CISA KEV listing and no public exploit reference in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified. The local attack vector plus required pre-existing low privileges sharply limit real-world risk: this is not a remotely exploitable, mass-scannable flaw, but rather a bounded information-disclosure issue useful mainly for post-compromise privilege/data escalation. The CVSS vector and the description agree (both indicate local access and limited read-only impact), so there is no vector/description conflict to flag.

An attacker who has already obtained a low-privileged local account on the operating system underlying HPE Networking Fabric Composer leverages the flaw to read certain files they should not have access to, potentially exposing sensitive configuration or credential material. The local attack vector and required low privileges (PR:L) mean this cannot be triggered remotely or by an unauthenticated user. No public exploit code or PoC reference is provided in the available data.