---
id: "CVE-2026-95744"
kind: "vulnerability"
aliases: ["CVE-2026-95744"]
title: "HPE Networking Fabric Composer: information disclosure lets an attacker intercept traffic"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe-networking", "infrastructure", "network-fabric"]
not_affected_if: ["no-fabric-composer-deployment", "unauthenticated-only-access"]
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:56:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95744", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:56:21+00:00"}]
---

# HPE Networking Fabric Composer: information disclosure lets an attacker intercept traffic

HPE Networking Fabric Composer has a sensitive information disclosure flaw in an affected interface. An authenticated low-privileged attacker can read sensitive data and may intercept protected network traffic when certain conditions outside their control are met.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether HPE Networking Fabric Composer is deployed and which version it runs. HPE's bulletin for this CVE was not retrievable, so no affected range is confirmed. HPE's related Sep 2026 bulletin HPESBNW05133 listed Fabric Composer 7.3.3 and below as affected, with fixes in 7.3.4 and 7.4.0. Also check whether this CVE is covered by the Nov 3 bulletin. - Interim step from that Sep bulletin: restrict CLI and web management interfaces to a dedicated L2 segment/VLAN or firewall policy.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95744
- 2026-11-03T20:56:21+00:00 analyst — HPE's CVE-2026-95744 bulletin (published 3 Nov 2026, announced in advance notice HPESBNW05166) is not yet on csaf.arubanetworking.hpe.com or retrievable. The Sep 1 bulletin HPESBNW05133 (fixes 7.3.4 and 7.4.0) is a different CVE batch; I could not confirm it lists this CVE, so I did not link it or set a fix. Versions, interface and fix are unknown. Revisit when the Nov 3 bulletin appears (check the csaf index for hpesbnw05166+ and networkingsupport.hpe.com/notification/security). Nothing verified.

## From the sources

A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept protected network traffic.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_