---
id: "CVE-2026-95735"
kind: "vulnerability"
aliases: ["CVE-2026-95735"]
title: "HPE Networking Fabric Composer: certificate validation flaw can expose credentials"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking Fabric Composer", "fixed": [], "affected": "unknown (HPE has not published versions)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hpe", "infrastructure", "network-management", "networking-fabric-composer"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:00:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95735", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:00:29+00:00"}]
---

# HPE Networking Fabric Composer: certificate validation flaw can expose credentials

HPE Networking Fabric Composer does not properly validate certificates, so a network attacker can be trusted in place of the real service. A successful attack can reveal sensitive information, including credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking Fabric Composer affected unknown (HPE has not published versions) fixed ?

## How to check

Unknown until HPE publishes the bulletin. Check your Fabric Composer version in the UI and compare it with HPE's Nov 3 2026 advisory when it is out. Also check whether Fabric Composer connects to other systems (switches, directories, integrations) over TLS without strict certificate verification.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95735
- 2026-11-03T21:00:29+00:00 analyst — HPE's own advisory for this CVE is not published yet: the CSAF index (csaf.arubanetworking.hpe.com/2026) has nothing newer than hpesbnw05171, and the Nov 3 advance notice HPESBNW05166 lists Fabric Composer but gives no versions or CVE ids (the page text I could read was empty). The Sept advisory HPESBNW05133 (7.3.3 and below, fixed in 7.3.4 / 7.4.0) covers other CVEs, so I did not apply its ranges here. Fix and affected versions stay unknown until the Nov 3 bulletin appears; revisit then.

## Documents

- [mentions] HPESBNW05166 rev.1 - HPE Networking Advance Notification of Security Advisories for November 03, 2026 https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05166en_us&docLocale=en_US

## From the sources

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_