---
id: "CVE-2026-95746"
kind: "vulnerability"
aliases: ["CVE-2026-95746"]
title: "HPE Networking Fabric Composer: API authentication bypass lets unauthenticated adjacent attackers in"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["adjacent-network", "api", "fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:23+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:55:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95746", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:55:06+00:00"}]
---

# HPE Networking Fabric Composer: API authentication bypass lets unauthenticated adjacent attackers in

HPE Networking Fabric Composer has an authentication bypass in its API endpoint. An unauthenticated attacker on an adjacent network can get past login controls and reach the system without credentials, when certain preconditions outside their control are met.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: check the installed Fabric Composer version in the UI and compare with HPE's Nov 3 2026 bulletin once published; the bulletin is not yet readable. Also check whether the API is reachable from adjacent network segments.

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95746
- 2026-11-03T20:55:06+00:00 analyst — HPE's Nov 3 2026 bulletin for this CVE is not indexed yet; only advance notice HPESBNW05166 (no versions) found. Sibling Sep 1 bulletin HPESBNW05133 fixed 7.3.4/7.4.0 for different CVEs; not applied here. Versions, fix and preconditions unknown until the bulletin is readable; revisit.

## Documents

- [describes] NVD CVE-2026-95746 https://nvd.nist.gov/vuln/detail/CVE-2026-95746
- [mentions] HPE Networking Security Alerts & Advisories (lists HPESBNW05166 advance notice for Nov 3, 2026: VIA, Fabric Composer) https://networkingsupport.hpe.com/notification/security

## From the sources

An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_