---
id: "CVE-2026-95736"
kind: "vulnerability"
aliases: ["CVE-2026-95736"]
title: "HPE Networking Fabric Composer: certificate validation flaw lets attackers intercept data"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fabric Composer", "fixed": ["7.3.5", "7.4.1"], "affected": "<= 7.3.4, 7.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent-network", "fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: ["fixed-version-7.3.5", "fixed-version-7.4.1", "unknown"]
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T21:00:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95736", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:00:39+00:00"}]
---

# HPE Networking Fabric Composer: certificate validation flaw lets attackers intercept data

HPE Networking Fabric Composer does not properly validate certificates on an affected interface. An attacker on an adjacent network can intercept sensitive information if certain conditions outside their control are met.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fabric Composer affected <= 7.3.4, 7.4.0 fixed 7.3.5, 7.4.1

## How to check

Check the installed Fabric Composer version: affected if 7.4.0 or below, or 7.3.4 or below. HPE does not say how to read the version or name the affected interface; see the portal. Also check whether the management network is shared with untrusted hosts, since the attacker must be adjacent.

## Fix

Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x branch) or 7.3.5 or later (7.3.x branch); download from the HPE Networking Support Portal.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95736
- 2026-11-03T21:00:39+00:00 analyst — Read HPE CSAF advisory HPESBNW05172 (2026-Nov-03). Affected 7.4.0 and below, 7.3.4 and below; fixed 7.4.1+/7.3.5+. HPE does not name the interface. No exploitation or public discussion known per HPE. X not checked (not needed).

## Documents

- [advisory] HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt

## From the sources

Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_