{"id":"CVE-2026-95744","kind":"vulnerability","aliases":["CVE-2026-95744"],"related":[],"title":"HPE Networking Fabric Composer: information disclosure lets an attacker intercept traffic","description":"A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept protected network traffic.","summary":"HPE Networking Fabric Composer has a sensitive information disclosure flaw in an affected interface. An authenticated low-privileged attacker can read sensitive data and may intercept protected network traffic when certain conditions outside their control are met.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe-networking","infrastructure","network-fabric"],"not_affected_if":["no-fabric-composer-deployment","unauthenticated-only-access"],"how_to_check":"- Check whether HPE Networking Fabric Composer is deployed and which version it runs. HPE's bulletin for this CVE was not retrievable, so no affected range is confirmed. HPE's related Sep 2026 bulletin HPESBNW05133 listed Fabric Composer 7.3.3 and below as affected, with fixes in 7.3.4 and 7.4.0. Also check whether this CVE is covered by the Nov 3 bulletin. - Interim step from that Sep bulletin: restrict CLI and web management interfaces to a dedicated L2 segment/VLAN or firewall policy.","fix":null,"status":"open","published_at":"2026-11-03T20:18:22+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:50:01+00:00","updated_at":"2026-11-03T20:56:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:50:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: information disclosure lets an attacker intercept traffic","impact":"medium","summary":"HPE Networking Fabric Composer has a sensitive information disclosure flaw in an affected interface. An authenticated low-privileged attacker can read sensitive data and may intercept protected network traffic when certain conditions outside their control are met.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-networking","fabric-composer","network-fabric"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive data and intercepts protected network traffic","analyst_note":"Find the affected versions, the vulnerable interface and the vendor fix in HPE's security bulletin for CVE-2026-95744; NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-95744) gives no version ranges.","how_to_check":"- Check whether Fabric Composer is deployed in your environment and which version is running; the sources do not give a version command.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","no-fabric-composer-deployment"],"who_is_affected":"Teams running HPE Networking Fabric Composer are exposed. Exploitation requires a low-privileged authenticated account and preconditions outside the attacker's control. The sources do not name the affected versions or the specific interface.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4127,"output_tokens":562,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected versions, the vulnerable interface and the vendor fix in HPE's security bulletin for CVE-2026-95744; NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-95744) gives no version ranges.","search":"'-2026':13A,16A '-95744':14A,17A 'access':89C 'affect':40B,73C 'allow':81C,106C 'attack':9A,47B,87C,98C,108C 'authent':43B,83C 'certain':59B,93C 'compos':4A,20B,31B,79C 'condit':60B 'control':63B,100C 'could':80C,105C 'cve':12A,15A 'data':51B 'disclosur':6A,36B,69C 'exploit':104C 'fabric':3A,19B,27B,30B,78C 'fabric-compos':18B 'flaw':37B 'hpe':1A,22B,28B,76C 'hpe-network':21B 'inform':5A,35B,68C,91C 'infrastructur':24B 'intercept':10A,54B,110C 'interfac':41B,74C 'let':7A 'low':45B,85C 'low-privileg':44B,84C 'may':53B 'met':65B,102C 'network':2A,23B,26B,29B,56B,77C,112C 'network-fabr':25B 'outsid':61B,95C 'precondit':94C 'privileg':46B,86C 'protect':55B,111C 'read':49B 'sensit':34B,50B,67C,90C 'success':103C 'traffic':11A,57B,113C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer, the network-fabric management platform, may be exposed. The flaw needs an authenticated low-privileged account and conditions the attacker does not control, and could let them intercept protected network traffic. HPE's bulletin for this CVE was not available when this was written, so the affected versions and interface are unconfirmed. Deployments without Fabric Composer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","high","hpenetworking","infrastructure","networkfabric"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95744","severity":null,"published_at":"2026-11-03T20:18:22+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95744:1542","url":null,"severity":null,"published_at":"2026-11-03T20:56:21+00:00","modified_at":"2026-11-03T20:56:21+00:00","first_seen_at":"2026-11-03T20:56:21+00:00","fetched_at":"2026-11-03T20:56:21+00:00","note":"HPE's CVE-2026-95744 bulletin (published 3 Nov 2026, announced in advance notice HPESBNW05166) is not yet on csaf.arubanetworking.hpe.com or retrievable. The Sep 1 bulletin HPESBNW05133 (fixes 7.3.4 and 7.4.0) is a different CVE batch; I could not confirm it lists this CVE, so I did not link it or set a fix. Versions, interface and fix are unknown. Revisit when the Nov 3 bulletin appears (check the csaf index for hpesbnw05166+ and networkingsupport.hpe.com/notification/security). Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}