---
id: "CVE-2026-95733"
kind: "vulnerability"
aliases: ["CVE-2026-95733"]
title: "HPE Networking Fabric Composer: unauthenticated adjacent attacker can run code"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["adjacent-network", "fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: []
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T20:50:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95733", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:50:59+00:00"}]
---

# HPE Networking Fabric Composer: unauthenticated adjacent attacker can run code

A component of HPE Networking Fabric Composer contains a flaw that lets an attacker on an adjacent network run arbitrary code on the affected system. The sources rate it critical (CVSS 9.6) and say no authentication is needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown for this CVE. Also check your Fabric Composer version: the Sep 2026 bulletin HPESBNW05133 lists 7.3.3 and below as affected, fixed in 7.3.4 or 7.4.0 and above; confirm against HPE's bulletin for CVE-2026-95733.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95733
- 2026-11-03T20:50:59+00:00 analyst — No HPE bulletin naming CVE-2026-95733 found. HPESBNW05133 (2026-Sep-01) covers Fabric Composer <=7.3.3, fixed 7.3.4 / 7.4.0, and lists a near-identical adjacent unauth RCE (CVE-2026-19766, CVSS 9.6, same vector) but under a different ID; 95733 was published 2026-11-03 and may be in a newer HPE bulletin (HPESBNW05166 advance notice lists Fabric Composer). Not confirmed same flaw; nothing verified. Fix and versions unknown; settle by reading the HPE Nov 3 2026 Fabric Composer bulletin. Sep bulletin workaround (restrict CLI/web management to a dedicated L2 segment/VLAN and firewall) is likely relevant to adjacent attacks.

## Documents

- [mentions] HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt

## From the sources

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_