---
id: "CVE-2026-95738"
kind: "vulnerability"
aliases: ["CVE-2026-95738"]
title: "HPE Networking Fabric Composer: remote authentication bypass can give admin access (fixed in 7.3.5 and 7.4.1)"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fabric Composer", "fixed": ["7.3.5", "7.4.1"], "affected": "<= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authentication-bypass", "fabric-composer", "hpe", "infrastructure", "networking", "self-hosted"]
not_affected_if: ["management-interface-isolated", "unknown"]
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:58:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95738", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:58:38+00:00"}]
---

# HPE Networking Fabric Composer: remote authentication bypass can give admin access (fixed in 7.3.5 and 7.4.1)

HPE Networking Fabric Composer has authentication bypass flaws in an affected interface. An unauthenticated remote attacker who meets certain preconditions outside their control can get past login and reach administrative access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fabric Composer affected <= 7.3.4 (7.3.x); <= 7.4.0 (7.4.x) fixed 7.3.5, 7.4.1

## How to check

Check the installed Fabric Composer version: 7.4.0 and below, or 7.3.4 and below, is affected; fixed is 7.4.1+ / 7.3.5+. Also check whether the CLI and web management interfaces are reachable from untrusted networks.

## Fix

Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x branch) or 7.3.5 or later (7.3.x branch); download from the HPE Networking Support Portal. Workaround from HPE: restrict the CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or control them with layer 3+ firewall policies, with accounting controls.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95738
- 2026-11-03T20:58:38+00:00 analyst — Read HPESBNW05172 (HPE, 2026-Nov-03): CVE-2026-95738 CVSS 8.1, remote unauth auth bypass, preconditions unspecified. Affected <=7.3.4 / <=7.4.0, fixed 7.3.5 / 7.4.1. HPE says no known public exploit or discussion. No vendor-side mitigations beyond the management-interface restriction workaround. Sept bulletin HPESBNW05133 covers different CVEs.

## Documents

- [advisory] HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt

## From the sources

Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_