HPE Fabric Composer EUVD-2026-116276

Exploitation requires the attacker to be on a logically adjacent network (AV:A) - the same L2/management segment as HPE Networking Fabric Composer - rather than arbitrary remote internet access; this is the primary limiting factor. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed and default configurations are affected, since the flaw is an authentication bypass in the appliance's underlying operating system. The specific protocol, port, or feature that triggers the bypass is not described in the available sources. Realistic risk is therefore bounded by how well the Fabric Composer management network is segmented and isolated from general or untrusted networks.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.6) describes a low-complexity, unauthenticated, no-user-interaction path to full compromise with a scope change, and the vuln.today decision label is act_now, reinforcing urgency. The single mitigating factor is the attack vector: AV:A (adjacent) means exploitation requires the attacker to already have a foothold on the same local/adjacent network segment as the Fabric Composer management interface, not arbitrary internet-wide reach - so this is not internet-facing remote RCE unless the management network is exposed. Signals partly conflict on confidence rather than on severity: there is no EPSS score, no CISA KEV listing, and no public exploit in the supplied data, so predicted and observed exploitation are both unquantified despite the act_now label. SSVC-style inputs (automatable, exploitation status) were not supplied. Net: treat as urgent patch-now given auth bypass + RCE on a network fabric controller, but note the adjacency requirement caps mass-exploitation likelihood relative to a true AV:N flaw.

An attacker who has gained a position on the network segment adjacent to the HPE Networking Fabric Composer (for example a compromised host on the management VLAN) sends traffic that bypasses authentication in the appliance's underlying operating system and executes arbitrary code on it, with no credentials or user interaction required. Because the vulnerability carries a scope change (S:C), code execution on the fabric controller can extend control over the managed network fabric. No public exploit identified at time of analysis.