EUVD-2026-69451
GHSA-whwx-9chv-mp2m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network API requires operator credentials (PR:L); settings modification yields high integrity impact with minor availability risk and no confidentiality exposure.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
AnalysisAI
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session as a low-privilege operator-role user on HPE Fabric Composer - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a genuinely high but bounded risk: exploitation unconditionally requires a valid operator-level account (PR:L), ruling out unauthenticated attack paths and significantly constraining the threat population compared to other HPE Fabric Composer CVEs in the same advisory (e.g., CVE-2026-76658 at CVSS 10.0, and CVE-2026-76657 involving unauthenticated API auth bypass). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult HPE security advisory HPESBNW05133 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the vendor-released patch; a specific fixed version number was not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HPE Networking Fabric Composer deployments and segment API access to trusted administrative networks using firewall rules or network isolation to prevent unauthorized operator access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today