Live › vulnerability › CVE-2026-95734
HPE Networking Fabric Composer's API exposes data beyond what a low-privileged user is authorized to see. An attacker with a basic authenticated account can obtain sensitive credentials stored on the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Anyone running HPE Networking Fabric Composer 7.4.0 or earlier, or 7.3.4 or earlier, where someone holds a low-privilege account that can reach the API. Such a user can read stored credentials beyond their permission level (CVSS 8.8). Unsupported (EoM/EoS) versions are presumed affected. HPE lists no exploit or public discussion as of 2026-11-03.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fabric Composer | vendor | <= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x) | 7.3.5, 7.4.1 |
7.4.0 and below, or and below, is affected7.3.47.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x), from the HPE Networking Support PortalEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95734")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.