---
id: "CVE-2026-95742"
kind: "vulnerability"
aliases: ["CVE-2026-95742"]
title: "HPE Networking Fabric Composer: local users can overwrite arbitrary system files"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "local-privilege", "networking-fabric-composer", "on-prem", "operating-system"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:56:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95742", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:56:19+00:00"}]
---

# HPE Networking Fabric Composer: local users can overwrite arbitrary system files

An arbitrary file write flaw exists in the operating system underneath HPE Networking Fabric Composer. An authenticated local attacker can create or overwrite files on the system with elevated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until HPE publishes the bulletin for CVE-2026-95742. Check your Fabric Composer version; HPE's Sep 2026 bulletin HPESBNW05133 fixed other flaws in 7.3.4 and 7.4.0, so 7.3.3 and earlier are at least exposed to those. Whether those releases also fix this CVE is not confirmed.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95742
- 2026-11-03T20:56:19+00:00 analyst — No HPE bulletin for this CVE found yet. HPE's list shows HPESBNW05166, an advance notice of Nov 3 2026 advisories covering Fabric Composer and VIA, so the real bulletin is probably imminent; I could not fetch its text. The Sep 1 bulletin HPESBNW05133 (fixes 7.3.4 / 7.4.0) covers a different set of CVEs, and I did not see this one in the portion I could read (the page was truncated). Affected and fixed versions are unknown and unverified. Re-check once the Nov 3 bulletin is up. x-cli not used.

## Documents

- [mentions] HPE Networking Security Alerts & Advisories (lists HPESBNW05166 advance notice for Nov 3, 2026: VIA, Fabric Composer) https://networkingsupport.hpe.com/notification/security
- [mentions] HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt

## From the sources

An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_