{"id":"CVE-2026-95739","kind":"vulnerability","aliases":["CVE-2026-95739"],"related":[],"title":"HPE Networking Fabric Composer: API lets attackers brute-force accounts into admin","description":"An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","summary":"HPE Networking Fabric Composer's API does not limit repeated login attempts, so an unauthenticated remote attacker can guess user passwords. A successful guess could give the attacker administrative access to the affected system.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","hpe","infrastructure","networking-fabric-composer"],"not_affected_if":["unknown"],"how_to_check":"HPE has not published a per-CVE advisory I could read for this ID. Check your Fabric Composer version in the web UI or CLI. HPE's September advisory (HPESBNW05133) lists 7.3.3 and below as affected for its CVEs, but this CVE was not found in it. Also check whether the management API is reachable from untrusted networks, and review API logs for repeated failed logins.","fix":null,"status":"open","published_at":"2026-11-03T20:18:22+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:49:54+00:00","updated_at":"2026-11-03T20:58:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: API lets attackers brute-force accounts into admin","impact":"high","summary":"HPE Networking Fabric Composer's API does not limit repeated login attempts, so an unauthenticated remote attacker can guess user passwords. A successful guess could give the attacker administrative access to the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","api"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker guesses admin passwords and takes full control of the system","analyst_note":"Find the HPE advisory for affected and fixed versions, the required preconditions, and whether the API is exposed by default; NVD alone lacks these.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running HPE Networking Fabric Composer whose API is reachable by an attacker, under the preconditions the advisory describes as outside the attacker's control. The sources do not list affected versions or the exact preconditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4138,"output_tokens":450,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE advisory for affected and fixed versions, the required preconditions, and whether the API is exposed by default; NVD alone lacks these.","search":"'-2026':15A,18A '-95739':16A,19A 'access':56B,112C 'account':11A,91C 'admin':13A 'administr':55B,111C 'affect':59B,115C 'allow':78C,106C 'api':5A,20B,32B,71C 'attack':7A,43B,54B,82C,88C,98C,108C 'attempt':38B,67C 'authent':66C 'brute':9A,86C 'brute-forc':8A,85C 'certain':93C 'compos':4A,26B,30B,76C 'conduct':84C 'control':100C 'could':51B,77C,105C 'cve':14A,17A 'excess':65C 'exploit':104C 'fabric':3A,25B,29B,75C 'forc':10A,87C 'gain':110C 'give':52B 'guess':45B,50B 'hpe':1A,21B,27B,73C 'improp':62C 'infrastructur':22B 'let':6A 'limit':35B 'login':37B 'met':102C 'network':2A,24B,28B,74C 'networking-fabric-compos':23B 'outsid':95C 'password':47B 'precondit':94C 'remot':42B,81C 'repeat':36B 'restrict':63C 'success':49B,103C 'system':60B,116C 'unauthent':41B,80C 'user':46B,90C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"HPE Networking Fabric Composer deployments whose management API accepts unlimited login attempts, so a remote unauthenticated attacker can guess passwords and, if one works, gain administrative access. Affected versions and the fixed release are not confirmed: no HPE advisory naming this CVE was found. Teams not running Fabric Composer, or with the API reachable only from a restricted management network, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["api","high","hpe","infrastructure","networkingfabriccomposer"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95739","severity":null,"published_at":"2026-11-03T20:18:22+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95739:1546","url":null,"severity":null,"published_at":"2026-11-03T20:58:21+00:00","modified_at":"2026-11-03T20:58:21+00:00","first_seen_at":"2026-11-03T20:58:21+00:00","fetched_at":"2026-11-03T20:58:21+00:00","note":"Searched HPE: the CSAF text for HPESBNW05133 (Sep 1, fixes 7.3.4/7.4.0) did not list this CVE in the part I could read, and the Nov 3 advisory (advance notice HPESBNW05166 names Fabric Composer) was not found yet. NVD page returned no text. Nothing verified; no fix version or default-exposure info confirmed. Revisit once the Nov 3 HPE bulletin is up."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}