---
id: "CVE-2026-95745"
kind: "vulnerability"
aliases: ["CVE-2026-95745"]
title: "HPE Fabric Composer API: unauthenticated attacker can take management services offline"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hpe-networking-fabric-composer", "infrastructure", "network-management"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:22+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:56:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95745", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:56:01+00:00"}]
---

# HPE Fabric Composer API: unauthenticated attacker can take management services offline

A flaw in the API of HPE Networking Fabric Composer lets a remote attacker with no login cause denial of service. A successful attack makes the management services unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check your Fabric Composer version in its web UI or CLI and whether its API is reachable from untrusted networks. Affected range for this CVE is not yet published in a source we could read; HPE's Sept 2026 bulletin HPESBNW05133 (a different set of CVEs) fixed 7.3.4 and 7.4.0, but do not assume it covers this one. Look for HPE's Nov 3, 2026 Fabric Composer bulletin on networkingsupport.hpe.com.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95745
- 2026-11-03T20:56:01+00:00 analyst — No primary advisory found. NVD only; HPE listed Fabric Composer in advance notice HPESBNW05166 (Oct 27) for Nov 3 but the bulletin text was not retrievable. Sept bulletin HPESBNW05133 does not list this CVE, so its versions are not applied. Nothing verified. Revisit when bulletin is indexed.

## Documents

- [describes] NVD CVE-2026-95745 https://nvd.nist.gov/vuln/detail/CVE-2026-95745
- [mentions] HPE Networking security alerts and notifications https://networkingsupport.hpe.com/notifications

## From the sources

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_