HPE Fabric Composer EUVD-2026-116278

Exploitation requires a valid authenticated account on HPE Networking Fabric Composer with low privileges (CVSS PR:L); it is not exploitable by fully unauthenticated attackers. The attacker then abuses the product's API to read data beyond the account's authorized privilege level, specifically sensitive credentials stored on the system. The limiting factor is that an attacker must first obtain or be granted valid low-privileged API credentials; no end-user interaction is required (UI:N) and the attack is network-reachable (AV:N). The specific API endpoint, feature, or configuration that exposes the data is not described in the available sources.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw in the Fabric Composer API exploitable with low complexity by an authenticated low-privileged user (PR:L), which per the precision rules makes this an authenticated issue rather than unauthenticated. However, the input CVSS claims C:H/I:H/A:H (base 8.8) while the description characterizes the flaw strictly as sensitive information disclosure that lets a user read data beyond their authorization - an impact to confidentiality only. The I:H and A:H metrics are not supported by any text in the available evidence, so the 8.8 severity appears inflated relative to the described mechanism; a confidentiality-only reading would score materially lower. No EPSS score, KEV listing, or POC reference is present in the input, so there is no public exploitation signal. The vuln.today Decision label is 'this_week,' indicating elevated but non-emergency priority. Net: this is a credible privilege-boundary/credential-exposure issue worth prioritizing within the week because it discloses stored credentials (enabling follow-on lateral movement), but the raw 8.8 overstates integrity and availability impact that the description does not substantiate - verify the true impact scope with HPE advisory hpesbnw05172en_us.

An attacker who already holds a low-privileged account on HPE Networking Fabric Composer sends crafted requests to the management API and receives data outside their authorized scope, including sensitive credentials stored on the system. Those harvested credentials can then be reused to escalate access or pivot to the managed network fabric. No public exploit code is identified in the available sources.