Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer

Hewlett Packard Enterprise (HPE) Fabric Composer2026-11-03 20:18 UTC1 min readRead in

Summary

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.

Remediation

Inventory every Hewlett Packard Enterprise (HPE) Fabric Composer deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Referencehttps://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US

CVSS vector

Attack vector: Adjacent
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
7.4.0 – 7.4.0	None yet
7.0.0 – 7.3.4	None yet

Timeline

2026-11-03Publicly disclosed

Sources

NVD · CVE