---
id: "CVE-2026-95731"
kind: "vulnerability"
aliases: ["CVE-2026-95731"]
title: "HPE Networking Fabric Composer: hardcoded passwords give remote attackers admin access"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cli", "hardcoded-credentials", "hpe", "infrastructure", "networking-fabric-composer"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T20:50:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95731", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:50:53+00:00"}]
---

# HPE Networking Fabric Composer: hardcoded passwords give remote attackers admin access

HPE Networking Fabric Composer's command-line interface ships with hardcoded passwords. An unauthenticated remote attacker who uses them can gain administrative access with elevated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95731
- 2026-11-03T20:50:53+00:00 analyst — HPE's primary bulletin for this CVE not found: HPE advance notice HPESBNW05166 (Nov 3 2026, lists Fabric Composer, no versions) and the CVE published today; the Nov 3 bulletin isn't indexed yet. Sep bulletin HPESBNW05133 (7.3.3 and below, fixed 7.3.4/7.4.0) is a different CVE set and I did not see this CVE in the part I could read, so I did not apply those versions. No versions, fix or CLI default-exposure confirmed; nothing verified. Revisit once the Nov 3 bulletin posts (networkingsupport.hpe.com/notification/security). HPE's generic workaround for Fabric Composer CLI/web: restrict to dedicated L2 segment/VLAN or L3 firewall policies.

## From the sources

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_