---
id: "CVE-2026-95739"
kind: "vulnerability"
aliases: ["CVE-2026-95739"]
title: "HPE Networking Fabric Composer: API lets attackers brute-force accounts into admin"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api", "hpe", "infrastructure", "networking-fabric-composer"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:58:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95739", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:58:21+00:00"}]
---

# HPE Networking Fabric Composer: API lets attackers brute-force accounts into admin

HPE Networking Fabric Composer's API does not limit repeated login attempts, so an unauthenticated remote attacker can guess user passwords. A successful guess could give the attacker administrative access to the affected system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

HPE has not published a per-CVE advisory I could read for this ID. Check your Fabric Composer version in the web UI or CLI. HPE's September advisory (HPESBNW05133) lists 7.3.3 and below as affected for its CVEs, but this CVE was not found in it. Also check whether the management API is reachable from untrusted networks, and review API logs for repeated failed logins.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95739
- 2026-11-03T20:58:21+00:00 analyst — Searched HPE: the CSAF text for HPESBNW05133 (Sep 1, fixes 7.3.4/7.4.0) did not list this CVE in the part I could read, and the Nov 3 advisory (advance notice HPESBNW05166 names Fabric Composer) was not found yet. NVD page returned no text. Nothing verified; no fix version or default-exposure info confirmed. Revisit once the Nov 3 HPE bulletin is up.

## From the sources

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_