EUVD-2026-69431
GHSA-vhgg-89gv-3hfg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requiring only operator credentials (PR:L), no interaction or special conditions, and complete system-level compromise upon successful exploitation.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.
AnalysisAI
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege operator-tier account on the target HPE Networking Fabric Composer instance (confirmed by PR:L in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (High) accurately reflects a network-accessible, low-complexity attack requiring only operator-level credentials, with full C:H/I:H/A:H impact on the Fabric Composer system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult and apply the guidance in HPE security advisory HPESBNW05133 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US; a patch is indicated per vendor advisory, though the exact fixed version number was not determinable from the data available for this analysis and must be confirmed directly from HPE. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately audit all low-privilege operator accounts in HPE Fabric Composer and revoke unnecessary administrative privileges; enable detailed API logging to detect exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent netwo
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today