Live › vulnerability › CVE-2026-95741
HPE says the Fabric Composer API lacks an integrity verification check, so an authenticated low-privileged attacker can gain elevated privileges. Fixed in 7.4.1 and 7.3.5. HPE found it internally and knows of no public discussion or exploit code. HPE's workaround: restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall policies, with accounting controls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Anyone running HPE Networking Fabric Composer (AFC) 7.4.0 or earlier, or 7.3.4 or earlier, where a low-privileged account can reach the API. It needs a valid login first, so risk is highest where operator accounts are shared or the management interface is broadly reachable. Teams not running Fabric Composer can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking Fabric Composer | vendor | <= 7.3.4, 7.4.0 | 7.3.5, 7.4.1 |
7.4.0 and 7.3.x up to (older end-of-maintenance releases are presumed affected)7.3.4Upgrade to Fabric Composer 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x); download from the HPE Networking Support Portal.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95741")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.