---
id: "CVE-2026-95737"
kind: "vulnerability"
aliases: ["CVE-2026-95737"]
title: "HPE Networking Fabric Composer: local privilege escalation on underlying host OS"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking Fabric Composer", "fixed": ["7.3.5", "7.4.1"], "affected": "<= 7.3.4, 7.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "networking", "privilege-escalation", "self-hosted"]
not_affected_if: ["product-not-deployed"]
published_at: "2026-11-03T20:18:21+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:58:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95737", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:58:03+00:00"}]
---

# HPE Networking Fabric Composer: local privilege escalation on underlying host OS

A local attacker who already holds high privileges on HPE Networking Fabric Composer can escalate to elevated privileges on the underlying host operating system. The sources give no further detail on the flaw or affected versions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking Fabric Composer affected <= 7.3.4, 7.4.0 fixed 7.3.5, 7.4.1

## How to check

Check the installed Fabric Composer version. Affected: 7.4.0 and below, 7.3.4 and below (end-of-maintenance releases are presumed affected). Also review who holds high-privilege or shell access on the Fabric Composer host.

## Fix

Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x); download from the HPE Networking Support Portal (networkingsupport.hpe.com).

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95737
- 2026-11-03T20:58:03+00:00 analyst — Read HPE advisory HPESBNW05172 (2026-11-03): CVE-2026-95737 local privesc on host OS, CVSS 8.2 High, AV:L PR:H. Affected 7.4.0 and below / 7.3.4 and below; fixed 7.4.1 / 7.3.5. HPE found it internally, no known public exploit. Advisory gives no specific workaround for this CVE beyond the general management-interface restriction.

## Documents

- [advisory] HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt

## From the sources

A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_