EUVD-2026-69451
GHSA-whwx-9chv-mp2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain operator-role credentials via phishing or credential compromise
-
DeliveryAuthenticate to Fabric Composer REST API
-
ExploitSend crafted request to privileged API endpoint
-
ExecutionBypass authorization check
-
ImpactModify restricted system configuration settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active authenticated session as a low-privilege operator-role user on HPE Fabric Composer - unauthenticated exploitation is not possible per the CVSS PR:L metric. The attack is fully network-based (AV:N), low complexity (AC:L), and requires no user interaction (UI:N), meaning once operator credentials are in hand, no additional conditions or user actions are needed. Limiting factors are: (1) the attacker must possess or compromise a valid operator-level account; (2) the vulnerability only affects systems where operator-role accounts have been provisioned - deployments using only administrator accounts are not directly exposed via this vector. The specific API endpoints and settings affected are not disclosed in available data. |
| Impact | The CVSS 7.1 score reflects a genuinely high but bounded risk: exploitation unconditionally requires a valid operator-level account (PR:L), ruling out unauthenticated attack paths and significantly constraining the threat population compared to other HPE Fabric Composer CVEs in the same advisory (e.g., CVE-2026-76658 at CVSS 10.0, and CVE-2026-76657 involving unauthenticated API auth bypass). The integrity impact is rated High (I:H) - unauthorized configuration changes in a fabric orchestration system can alter network segmentation, routing, or access policies with potentially broad downstream consequences. Availability impact is Low (A:L) and confidentiality is absent (C:N). No EPSS data was supplied and no KEV listing was found, indicating this is not yet under active mass exploitation. The chained risk is notable: the co-reported unauthenticated vulnerabilities in the same product could grant the initial operator foothold that this privilege-escalation CVE then leverages upward. Any operator with a legitimate account - or an attacker who has compromised one - represents a viable threat actor. |
| Exploit ScenarioDerived | An insider threat or external attacker who has obtained valid operator-level credentials - through phishing, credential reuse, or by exploiting one of the co-reported unauthenticated HPE Fabric Composer vulnerabilities - authenticates to the Fabric Composer API and sends requests to privileged configuration endpoints without administrator-level tokens. The missing authorization check allows the low-privilege session to modify network fabric settings, potentially altering access policies, routing behavior, or security configurations across managed network segments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
RemediationAI
Consult HPE security advisory HPESBNW05133 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the vendor-released patch; a specific fixed version number was not independently confirmed from available data. As compensating controls pending patch deployment: audit and minimize operator-role account assignments, retaining only those strictly required for operational functions. Review API access logs for configuration-change operations originating from operator-role sessions, particularly those touching high-privilege settings. Where role granularity permits, restrict operator accounts to read-only API scopes until patching is complete. These controls reduce exposure but do not eliminate the underlying authorization flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Fabric Composer is an orchestration and management platform for HPE network fabrics, exposing a REST API for configuration and state management. The vulnerability represents an authorization control failure in this API layer, where certain endpoints or operations intended exclusively for administrator-role users can be invoked by operator-role accounts without proper privilege enforcement. The CWE field is listed as N/A, but the behavior aligns with CWE-269 (Improper Privilege Management) or CWE-285 (Improper Authorization) - missing or insufficient role-based access checks on privileged API methods. The wildcard CPE (cpe:2.3:a:hewlett_packard_enterprise_(hpe):fabric_composer:*:*:*:*:*:*:*:*) covers all versions, indicating no version is exempt from this vulnerability class.
Know when Fabric Composer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network API requires operator credentials (PR:L); settings modification yields high integrity impact with minor availability risk and no confidentiality exposure.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
Executive ViewAI
HPE Networking Fabric Composer contains a privilege escalation flaw (CVSS 7.1) enabling authenticated operator-level users to invoke administrative API operations, creating a direct threat to network fabric integrity and configuration governance. Organizations deploying Fabric Composer in production environments face risk of unauthorized system modifications that could disrupt network services or enable lateral movement across managed infrastructure. The absence of available patches makes this vulnerability a sustained risk that requires immediate mitigation and active vendor monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation to restrict Fabric Composer API access to trusted administrative subnets; (2) Deploy enhanced logging and real-time alerting on all API operations, with focus on operations initiated by low-privilege accounts; (3) Enforce multi-factor authentication on operator and administrative accounts; (4) Audit and revoke unnecessary operator permissions; (5) Establish change-control procedures requiring approval for fabric configuration modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Exploit-DB