Fabric Composer EUVD-2026-116277

Exploitation requires the attacker to be adjacent to the target - on the same logical/broadcast network segment (AV:A), such as the Fabric Composer management network or VLAN - rather than anywhere on the internet; it is not reachable by a purely remote attacker without that network position. No authentication is required (PR:N) and no user interaction is needed (UI:N), so against a reachable, default deployment an unauthenticated adjacent attacker can trigger it directly. The primary limiting factor is therefore network adjacency and exposure of the management plane; the exact vulnerable component, affected versions, and whether any non-default configuration is involved are not described in the available sources and must be confirmed from the HPE advisory.

Multiple signals align toward genuine high priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes unauthenticated, low-complexity, no-interaction code execution reachable from an adjacent network, with a scope change and full confidentiality/integrity/availability loss - the maximum realistic profile short of a fully remote (AV:N) flaw. The vuln.today decision label is 'act_now', and the issue is vendor-reported by HPE (security-alert@hpe.com) and tagged RCE, reinforcing that this is treated as urgent. Counterbalancing this, no EPSS probability, no CISA KEV listing, and no proof-of-concept reference were provided in the input, so there is currently no evidence of in-the-wild or public exploitation - the urgency rests on the severity and vendor decision signal, not on observed attacker activity. One signal to verify: the vector is adjacent (AV:A), not network (AV:N), so exploitation requires the attacker to already have a foothold on the same logical/adjacent network segment as the appliance, which meaningfully narrows exposure compared with an internet-wide remote RCE. The CVSS, the RCE tag, and the HPE advisory are mutually consistent; the main gaps are the absence of EPSS/KEV/POC data and a CWE (listed N/A), so the mechanism of the flaw is not characterized.

An attacker who has gained a position on the same adjacent network segment as the Fabric Composer appliance (for example a compromised host in the management VLAN) sends crafted traffic to the vulnerable component without needing any credentials or user interaction. Because the CVSS vector is AV:A/PR:N/UI:N with a scope change, successful exploitation yields arbitrary code execution and can impact resources beyond the vulnerable component itself. No public exploit was identified in the provided data, so this scenario is inferred from the CVSS vector rather than from a demonstrated PoC.