{"id":"CVE-2026-95745","kind":"vulnerability","aliases":["CVE-2026-95745"],"related":[],"title":"HPE Fabric Composer API: unauthenticated attacker can take management services offline","description":"A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.","summary":"A flaw in the API of HPE Networking Fabric Composer lets a remote attacker with no login cause denial of service. A successful attack makes the management services unavailable.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe-networking-fabric-composer","infrastructure","network-management"],"not_affected_if":["unknown"],"how_to_check":"Check your Fabric Composer version in its web UI or CLI and whether its API is reachable from untrusted networks. Affected range for this CVE is not yet published in a source we could read; HPE's Sept 2026 bulletin HPESBNW05133 (a different set of CVEs) fixed 7.3.4 and 7.4.0, but do not assume it covers this one. Look for HPE's Nov 3, 2026 Fabric Composer bulletin on networkingsupport.hpe.com.","fix":null,"status":"open","published_at":"2026-11-03T20:18:22+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:50:08+00:00","updated_at":"2026-11-03T20:56:01+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:50:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Fabric Composer API: unauthenticated attacker can take management services offline","impact":"low","summary":"A flaw in the API of HPE Networking Fabric Composer lets a remote attacker with no login cause denial of service. A successful attack makes the management services unavailable.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-networking-fabric-composer","network-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Management services become unavailable until restarted; no code execution stated.","analyst_note":"Find the affected and fixed versions and the exposed API endpoints in the NVD entry or HPE's security bulletin.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run HPE Networking Fabric Composer with its API reachable over the network are exposed. The sources do not state which versions are affected or which API paths are involved. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":4104,"output_tokens":409,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed versions and the exposed API endpoints in the NVD entry or HPE's security bulletin.","search":"'-2026':13A,16A '-95745':14A,17A 'allow':67C,82C 'api':4A,31B,60C 'attack':6A,40B,50B,71C,78C,84C 'becom':91C 'caus':44B,86C 'compos':3A,22B,36B,65C 'conduct':73C 'could':66C,81C 'cve':12A,15A 'denial':45B,75C 'exploit':80C 'fabric':2A,21B,35B,64C 'flaw':28B 'hpe':1A,19B,33B,62C 'hpe-networking-fabric-compos':18B 'infrastructur':23B 'let':37B 'login':43B 'make':51B 'manag':9A,26B,53B,88C 'network':20B,25B,34B,63C 'network-manag':24B 'offlin':11A 'remot':39B,70C 'servic':10A,47B,54B,77C,89C 'success':49B,79C 'take':8A 'unauthent':5A,69C 'unavail':55B,92C 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer with its API reachable over the network are exposed to an unauthenticated denial of service (CVSS 7.5, availability only, no data loss stated). HPE's bulletin for this CVE has not been found, so affected versions, fixed versions and API endpoints are unknown. Teams that keep the management interfaces on an isolated segment can lower the risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hpenetworkingfabriccomposer","infrastructure","networkmanagement"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95745","severity":null,"published_at":"2026-11-03T20:18:22+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95745:1541","url":null,"severity":null,"published_at":"2026-11-03T20:56:01+00:00","modified_at":"2026-11-03T20:56:01+00:00","first_seen_at":"2026-11-03T20:56:01+00:00","fetched_at":"2026-11-03T20:56:01+00:00","note":"No primary advisory found. NVD only; HPE listed Fabric Composer in advance notice HPESBNW05166 (Oct 27) for Nov 3 but the bulletin text was not retrievable. Sept bulletin HPESBNW05133 does not list this CVE, so its versions are not applied. Nothing verified. Revisit when bulletin is indexed."}],"documents":[{"id":60654,"url":"https://networkingsupport.hpe.com/notifications","title":"HPE Networking security alerts and notifications","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":60655,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95745","title":"NVD CVE-2026-95745","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}