---
id: "CVE-2026-95732"
kind: "vulnerability"
aliases: ["CVE-2026-95732"]
title: "HPE Fabric Composer: authentication bypass in operating system allows code execution"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "network-appliance"]
not_affected_if: []
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T20:50:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95732", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:50:52+00:00"}]
---

# HPE Fabric Composer: authentication bypass in operating system allows code execution

An authentication bypass in the operating system underneath HPE Networking Fabric Composer lets an unauthenticated attacker on an adjacent network run arbitrary code on the affected system. The sources give a CVSS score of 9.6 and say nothing about exploitation in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Confirm whether HPE Networking Fabric Composer (AFC) is deployed and note the version. HPE's Sep 2026 bulletin HPESBNW05133 lists 7.3.3 and below as affected by the similar CVE-2026-19766; whether CVE-2026-95732 covers the same versions is unconfirmed. Watch the HPE Networking security advisories page for the November 2026 bulletin.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95732
- 2026-11-03T20:50:52+00:00 analyst — No HPE advisory found that lists CVE-2026-95732 (published 2026-11-03; HPE's Nov 3 advance notice HPESBNW05166 names Fabric Composer but the bulletin is not located). The identical-text, same-score (9.6, AV:A) bug is CVE-2026-19766 in HPESBNW05133 (Sep 1 2026; affected <=7.3.3, fixed 7.3.4 / 7.4.0; workaround: restrict management to a dedicated L2 segment/VLAN or firewall). Possible duplicate or re-issue; code decides merges. Linked as mentions only; nothing verified. Revisit when the Nov 3 HPE bulletin appears.

## Documents

- [mentions] HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt

## From the sources

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_