Live › vulnerability › CVE-2026-95739
HPE Networking Fabric Composer's API does not limit repeated login attempts, so an unauthenticated remote attacker can guess user passwords. A successful guess could give the attacker administrative access to the affected system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
HPE Networking Fabric Composer deployments whose management API accepts unlimited login attempts, so a remote unauthenticated attacker can guess passwords and, if one works, gain administrative access. Affected versions and the fixed release are not confirmed: no HPE advisory naming this CVE was found. Teams not running Fabric Composer, or with the API reachable only from a restricted management network, are at much lower risk.
No product ranges from the sources yet.
7.3.3 and below as affected for its CVEs, but this CVE was not found in itUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95739")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.