The vulnerability is an access‑control failure (CWE‑863) in the HPE Fabric Composer API that lets an authenticated low‑privileged operator perform state‑changing actions such as modifying configuration settings. Because the platform does not enforce proper authorization checks, the attacker can elevate privileges and alter system behavior, potentially compromising the integrity of the network fabric and disrupting available services.

All versions of Hewlett Packard Enterprise’s Fabric Composer API are potentially affected, as the advisory does not disclose a specific affected version range. Until a vendor‑supplied fix is applied, any machine running the product and accessible to a low‑privilege account is at risk. The flaw applies to the API endpoints that perform configuration changes, so any deployment of Fabric Composer that exposes those endpoints is vulnerable.

The CVSS base score of 8.5 places this flaw in the ‘high’ severity range, but the EPSS score is listed as less than 1 %, indicating a very low current probability of exploitation in the wild. The vulnerability is not yet catalogued in CISA’s KEV list. Successful exploitation requires that the attacker possess a low‑privilege authenticated session and discover the state‑changing API endpoints; if achieved, the attacker can gain unauthorized configuration authority, which may lead to network outages or data integrity problems.