---
id: "CVE-2026-95740"
kind: "vulnerability"
aliases: ["CVE-2026-95740"]
title: "HPE Networking Fabric Composer: improper certificate checks let attackers intercept traffic"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: []
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:58:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95740", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:58:03+00:00"}]
---

# HPE Networking Fabric Composer: improper certificate checks let attackers intercept traffic

HPE Networking Fabric Composer does not properly validate certificates, so an unauthenticated attacker on an adjacent network can intercept communications between the system and remote servers when certain outside conditions hold. Successful interception could expose sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until HPE's bulletin is readable. Check your Fabric Composer version in the UI or CLI. The September bulletin HPESBNW05133 covered 7.3.3 and below, but it is not confirmed to cover this CVE.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95740
- 2026-11-03T20:58:03+00:00 analyst — HPE's advance notice HPESBNW05166 (Oct 27) lists Fabric Composer and VIA for Nov 3. I could not find the bulletin for this CVE: the cve.org page was empty and the CSAF text for 05166 returned nothing. Affected versions, fixed release and preconditions are unknown, so no product rows, fix or verified fields are written. Fix status 'none' on the record has no vendor page behind it. Settle it by reading the Nov 3 HPE bulletin, which should be on the csaf.arubanetworking.hpe.com/2026 index. No exploitation or PoC found. The September bulletin HPESBNW05133 covers other CVEs: fixed in 7.3.4 and 7.4.0.

## Documents

- [mentions] HPE Networking security alerts and notifications https://networkingsupport.hpe.com/notifications

## From the sources

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_