EUVD-2026-69450
GHSA-3gw8-rmrm-8cwc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain operator-level credentials
-
DeliveryAuthenticate to Fabric Composer web interface
-
ExploitCraft request targeting privileged management endpoint
-
ExecutionBypass role-based authorization check
-
ImpactExecute unauthorized state-changing action on platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid operator-level (low-privilege) credentials on the HPE Networking Fabric Composer platform and network access to the web-based management interface. Unauthenticated exploitation is not possible - the PR:L CVSS metric confirms authentication is a hard prerequisite. Exploitation is limited to state-changing actions (I:H) and does not expose confidential data (C:N). Defenders can limit realistic risk by auditing operator account provisioning, enforcing MFA, and restricting management interface access to trusted network segments. |
| Impact | The CVSS 7.1 base score reflects a meaningful but bounded risk: AV:N confirms the web interface is remotely accessible, AC:L indicates no special conditions beyond credentials, and PR:L anchors exploitation to authenticated operator accounts, which substantially limits the attack surface to insiders or attackers who have already compromised operator credentials. The I:H impact reflects the ability to alter platform state in unauthorized ways - potentially disrupting network fabric configuration - while C:N confirms no confidentiality exposure. No EPSS data was provided, no KEV listing exists, and no POC is known, meaning real-world exploitation risk is presently theoretical. The primary realistic threat is a malicious or compromised insider with operator access escalating their effective privileges within the platform. CVSS and description are consistent; no signal conflicts detected. |
| Exploit ScenarioDerived | An attacker with valid operator-level credentials authenticates to the HPE Fabric Composer web interface and sends crafted requests to management API endpoints that perform privileged state-changing operations - such as modifying network fabric configuration or administrative settings - that the platform should restrict to higher-privilege roles. Because authorization checks are insufficient, the requests succeed, allowing the operator to alter platform state beyond their sanctioned scope. No public exploit code is known, but the low attack complexity (AC:L, UI:N) means any attacker with credentials could attempt this without specialized tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
RemediationAI
Apply the vendor-released patch per HPE Security Bulletin HPESBNW05133en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US, which contains the authoritative fixed version information not determinable from the CPE wildcard alone. As compensating controls pending patching, restrict operator-level account provisioning to the minimum required personnel, enforce MFA on the web management interface to reduce the risk of credential compromise enabling exploitation, and audit operator account activity logs for unauthorized state-changing operations. Blocking external network access to the Fabric Composer web interface (restricting to management VLANs only) reduces the AV:N exposure but does not eliminate insider threat.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is a network automation and orchestration platform used to manage fabric-based networking infrastructure. The vulnerability resides in the web-based management interface, where role-based authorization controls fail to enforce privilege boundaries for operator-level accounts. The CPE string (cpe:2.3:a:hewlett_packard_enterprise_(hpe):fabric_composer:*:*:*:*:*:*:*:*) uses a version wildcard, indicating broad version coverage. CWE is unspecified (N/A) by the reporter, but the behavior - authenticated low-privilege users bypassing access controls to execute state-changing operations - is consistent with CWE-862 (Missing Authorization) or CWE-285 (Improper Authorization), where API or interface endpoints fail to verify that the requesting user's role permits the requested action.
Know when Fabric Composer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-accessible web interface requires operator credentials (PR:L); unauthorized state changes yield high integrity impact with no confidentiality or scope exposure.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform.
Executive ViewAI
HPE Networking Fabric Composer contains a privilege escalation vulnerability allowing authenticated operator-level users to execute configuration changes beyond their authorized scope, effectively bypassing role-based access controls. This increases the risk of unauthorized infrastructure modifications and potential service disruption. Organizations should immediately restrict operator account assignments and implement enhanced monitoring of state-changing operations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Reduce operator-level account assignments to minimum necessary personnel with documented justification; (2) Implement comprehensive audit logging and real-time alerting on all state-changing operations by operator accounts; (3) Enforce network-level access controls restricting management interface connections to trusted administrative subnets; (4) Temporarily restrict operator roles to read-only access where operationally feasible; (5) Increase monitoring frequency and deploy behavioral analytics to detect unauthorized configuration changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Exploit-DB