A local privilege escalation vulnerability exists in HPE Networking Fabric Composer, allowing an authenticated privileged user on the underlying host to raise their privileges to a higher role. The vulnerability is classified as CWE‑269, improper privilege assignment. In a successful exploitation, the attacker can modify the state of certain system settings, potentially affecting the integrity of the system configuration and undermining the intended separation of duties.

The affected product is Hewlett Packard Enterprise Fabric Composer. No specific version range is provided, indicating that all deployed instances of Fabric Composer may be susceptible until a vendor‑issued fix is applied.

The CVSS score of 4.4 denotes moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local; an attacker must already have authenticated privileged access on the host. With this access, the attacker can elevate privileges and change configuration settings, but no remote exploitation is indicated. The overall risk is moderate, primarily impacting the integrity of system configurations and potentially facilitating broader lateral movement if higher privileges are gained.