{"id":"CVE-2026-95743","kind":"vulnerability","aliases":["CVE-2026-95743"],"related":[],"title":"HPE Networking Fabric Composer: local attacker gains elevated privileges on OS","description":"Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.","summary":"A flaw in the operating system underneath HPE Networking Fabric Composer lets a local user with low privileges become more privileged on the machine. An attacker needs a local foothold first, such as an existing account on the box.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe","infrastructure","linux","networking-fabric-composer"],"not_affected_if":["no-local-access"],"how_to_check":"Unknown until HPE's bulletin is out. Check the Fabric Composer version in the web UI or CLI; HPE's earlier bulletin HPESBNW05133 lists 7.3.3 and below as affected by other flaws, but this CVE's range is not confirmed.","fix":null,"status":"open","published_at":"2026-11-03T20:18:22+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:49:59+00:00","updated_at":"2026-11-03T20:50:40+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:49:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HPE Networking Fabric Composer: local attacker gains elevated privileges on OS","impact":"high","summary":"A flaw in the operating system underneath HPE Networking Fabric Composer lets a local user with low privileges become more privileged on the machine. An attacker needs a local foothold first, such as an existing account on the box.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the affected system","analyst_note":"Find HPE's security bulletin for CVE-2026-95743 to confirm affected OS and Fabric Composer versions and the fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Teams running HPE Networking Fabric Composer on their own hardware or VMs are the ones exposed, since the flaw is in the underlying OS. The sources do not say which OS versions or Fabric Composer releases are affected. Systems where only trusted administrators have shell access are lower risk, but the sources do not quantify this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4101,"output_tokens":480,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find HPE's security bulletin for CVE-2026-95743 to confirm affected OS and Fabric Composer versions and the fixed release.","search":"'-2026':13A,16A '-95743':14A,17A 'account':60B 'affect':95C 'allow':82C 'attack':6A,50B,85C 'becom':43B 'box':63B 'compos':4A,24B,35B,78C 'could':81C 'cve':12A,15A 'elev':8A,91C 'escal':66C 'exist':59B,68C 'exploit':80C 'fabric':3A,23B,34B,77C 'first':55B 'flaw':26B 'foothold':54B 'gain':7A,90C 'hpe':1A,18B,32B,75C 'infrastructur':19B 'let':36B 'linux':20B 'local':5A,38B,53B,64C,84C 'low':41B,87C 'machin':48B 'need':51B 'network':2A,22B,33B,76C 'networking-fabric-compos':21B 'oper':29B,72C 'os':11A 'privileg':9A,42B,45B,65C,88C,92C 'success':79C 'system':30B,73C,96C 'under':71C 'underneath':31B 'user':39B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer on their own hardware or VMs are the ones exposed, since the flaw is in the underlying OS. The sources do not say which OS versions or Fabric Composer releases are affected. Systems where only trusted administrators have shell access are lower risk, but the sources do not quantify this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hpe","infrastructure","linux","networkingfabriccomposer"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95743","severity":null,"published_at":"2026-11-03T20:18:22+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95743:1532","url":null,"severity":null,"published_at":"2026-11-03T20:50:40+00:00","modified_at":"2026-11-03T20:50:40+00:00","first_seen_at":"2026-11-03T20:50:40+00:00","fetched_at":"2026-11-03T20:50:40+00:00","note":"HPE's Nov 3 2026 bulletin for this CVE is not yet published/indexed. Only the advance notice HPESBNW05166 (no versions by design) and the Sept bulletin HPESBNW05133 (7.3.3 and below; fixed 7.3.4/7.4.0; covers other CVEs, I did not see 95743 in the part I read) found. No versions or fix confirmed; nothing verified. Revisit when the bulletin appears on networkingsupport.hpe.com/notification/security."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}