{"id":"CVE-2026-95733","kind":"vulnerability","aliases":["CVE-2026-95733"],"related":[],"title":"HPE Networking Fabric Composer: unauthenticated adjacent attacker can run code","description":"A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","summary":"A component of HPE Networking Fabric Composer contains a flaw that lets an attacker on an adjacent network run arbitrary code on the affected system. The sources rate it critical (CVSS 9.6) and say no authentication is needed.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adjacent-network","fabric-composer","hpe","infrastructure","networking"],"not_affected_if":[],"how_to_check":"Unknown for this CVE. Also check your Fabric Composer version: the Sep 2026 bulletin HPESBNW05133 lists 7.3.3 and below as affected, fixed in 7.3.4 or 7.4.0 and above; confirm against HPE's bulletin for CVE-2026-95733.","fix":null,"status":"open","published_at":"2026-11-03T20:18:21+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:49:39+00:00","updated_at":"2026-11-03T20:50:59+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:49:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: unauthenticated adjacent attacker can run code","impact":"high","summary":"A component of HPE Networking Fabric Composer contains a flaw that lets an attacker on an adjacent network run arbitrary code on the affected system. The sources rate it critical (CVSS 9.6) and say no authentication is needed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking","fabric-composer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the affected system","analyst_note":"Find the affected versions, the vulnerable component and the vendor fix in HPE's security bulletin for CVE-2026-95733.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running HPE Networking Fabric Composer where the affected component is reachable from an adjacent network. The sources do not name the affected versions or the specific component, so exposure cannot be confirmed from this text.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000628,"input_tokens":4078,"output_tokens":441,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected versions, the vulnerable component and the vendor fix in HPE's security bulletin for CVE-2026-95733.","search":"'-2026':12A,15A '-95733':13A,16A '9.6':57B 'adjac':6A,18B,42B,81C 'adjacent-network':17B 'affect':49B,89C 'allow':78C 'arbitrari':45B,85C 'attack':7A,39B,82C 'authent':61B 'code':10A,46B,86C 'compon':27B,69C 'compos':4A,22B,32B,74C 'contain':33B 'could':77C 'critic':55B 'cve':11A,14A 'cvss':56B 'execut':84C 'exist':66C 'exploit':76C 'fabric':3A,21B,31B,73C 'fabric-compos':20B 'flaw':35B 'hpe':1A,23B,29B,71C 'infrastructur':24B 'let':37B 'need':63B 'network':2A,19B,25B,30B,43B,72C 'rate':53B 'run':9A,44B 'say':59B 'sourc':52B 'success':75C 'system':50B,90C 'unauthent':5A,80C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Organizations running HPE Networking Fabric Composer where the affected component is reachable from an adjacent network. The sources do not name the affected versions or the specific component, so exposure cannot be confirmed from this text.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adjacentnetwork","critical","fabriccomposer","hpe","infrastructure","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95733","severity":null,"published_at":"2026-11-03T20:18:21+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95733:1529","url":null,"severity":null,"published_at":"2026-11-03T20:50:59+00:00","modified_at":"2026-11-03T20:50:59+00:00","first_seen_at":"2026-11-03T20:50:59+00:00","fetched_at":"2026-11-03T20:50:59+00:00","note":"No HPE bulletin naming CVE-2026-95733 found. HPESBNW05133 (2026-Sep-01) covers Fabric Composer <=7.3.3, fixed 7.3.4 / 7.4.0, and lists a near-identical adjacent unauth RCE (CVE-2026-19766, CVSS 9.6, same vector) but under a different ID; 95733 was published 2026-11-03 and may be in a newer HPE bulletin (HPESBNW05166 advance notice lists Fabric Composer). Not confirmed same flaw; nothing verified. Fix and versions unknown; settle by reading the HPE Nov 3 2026 Fabric Composer bulletin. Sep bulletin workaround (restrict CLI/web management to a dedicated L2 segment/VLAN and firewall) is likely relevant to adjacent attacks."}],"documents":[{"id":60632,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt","title":"HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}