A command sanitization bypass in the API of HPE Networking Fabric Composer allows an authenticated low‑privilege operator user to inject arbitrary operating‑system commands. Successful exploitation can elevate the user’s permissions to that of an administrator, granting the attacker full control over the device and potentially compromising the broader network. The vulnerability is rated with a CVSS score of 8.8, indicating a high‑severity flaw that can lead to loss of confidentiality, integrity, and availability.

This flaw affects HPE Networking Fabric Composer, the configuration and orchestration tool used by Hewlett Packard Enterprise for its networking fabric. Specific affected versions were not listed in the advisory, so any installation of Fabric Composer should be examined for the presence of the vulnerability and patched accordingly.

The attack vector requires valid credentials to the API; the vulnerability is exploitable over the network by sending crafted requests. Because the CE is not listed in CISA KEV and no EPSS score is available, the likelihood of widespread exploitation is unknown, but the high CVSS score and privilege‑escalation nature mean the risk remains significant. Follow the vendor’s update to mitigate the threat.