EUVD-2026-69437
GHSA-3mwv-2gpx-w3rp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-accessible unauthenticated API endpoint, no complexity; high availability loss requiring manual recovery; limited OS write justifies I:L with no confidentiality impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the availability of the affected system, requiring manual intervention to restore functionality.
AnalysisAI
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS PR:N confirms the vulnerable API endpoint is accessible without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects a high-severity, no-authentication-required, network-accessible vulnerability in a management-plane product - a configuration that historically draws rapid attacker interest once details become public. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin HPESBNW05133 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US to obtain the vendor-released patch; no specific fixed version number is present in the available input data and cannot be confirmed without reading the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all HPE Fabric Composer systems in your environment, then restrict network access to the management API endpoints exclusively to authorized administrator IP ranges and VPNs through perimeter firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today