{"id":"CVE-2026-95747","kind":"vulnerability","aliases":["CVE-2026-95747"],"related":[],"title":"HPE Networking Fabric Composer: SSH flaw lets low-privilege users gain higher access","description":"A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.","summary":"A flaw in the SSH interface of HPE Networking Fabric Composer lets an authenticated low-privileged user exceed their authorized access level when certain preconditions outside the attacker's control are met. Successful exploitation gives unauthorized access to internal services of the affected system.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe","infrastructure","networking-fabric-composer","ssh"],"not_affected_if":["not-deployed","ssh-disabled"],"how_to_check":"- Confirm whether HPE Networking Fabric Composer is deployed and its SSH interface is reachable by low-privileged accounts\n- Read the Nov 3 2026 HPE Networking Fabric Composer bulletin on networkingsupport.hpe.com/notification/security for affected and fixed versions (not yet read by us)\n- Fabric Composer 7.3.3 and below was affected by other CVEs in HPESBNW05133 (Sept 2026); check the installed version anyway and apply the latest release","fix":null,"status":"open","published_at":"2026-11-03T20:18:23+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:50:09+00:00","updated_at":"2026-11-03T20:55:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:50:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: SSH flaw lets low-privilege users gain higher access","impact":"high","summary":"A flaw in the SSH interface of HPE Networking Fabric Composer lets an authenticated low-privileged user exceed their authorized access level when certain preconditions outside the attacker's control are met. Successful exploitation gives unauthorized access to internal services of the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","ssh"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged user reaches internal services and gains unauthorized access","analyst_note":"Find the HPE advisory for affected and fixed versions and the preconditions named in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-95747).","how_to_check":"- Confirm whether HPE Networking Fabric Composer is deployed and whether its SSH interface is reachable\n- Check the installed Fabric Composer version against the affected ranges in the HPE advisory (unknown from the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","ssh-disabled"],"who_is_affected":"Teams running HPE Networking Fabric Composer with its SSH interface enabled and low-privileged accounts that can log in. The sources do not describe the preconditions that must be met, and they do not list affected versions. Teams without Fabric Composer can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4143,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE advisory for affected and fixed versions and the preconditions named in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-95747).","search":"'-2026':16A,19A '-95747':17A,20A 'access':14A,49B,65B,102C,123C 'affect':71B,129C 'allow':89C,117C 'attack':56B,95C,109C,119C 'authent':41B,91C 'author':48B,99C 'certain':52B,104C 'compos':4A,26B,38B,86C 'control':58B,111C 'could':88C,116C 'cve':15A,18A 'escal':75C 'exceed':46B,97C 'exist':77C 'exploit':62B,115C 'fabric':3A,25B,37B,85C 'flaw':6A,29B 'gain':12A,121C 'give':63B 'higher':13A 'hpe':1A,21B,35B,83C 'infrastructur':22B 'interfac':33B,81C 'intern':67B,125C 'let':7A,39B 'level':50B,100C 'low':9A,43B,93C 'low-privileg':8A,42B,92C 'met':60B,113C 'network':2A,24B,36B,84C 'networking-fabric-compos':23B 'outsid':54B,106C 'precondit':53B,105C 'privileg':10A,44B,74C,94C 'servic':68B,126C 'ssh':5A,27B,32B,80C 'success':61B,114C 'system':72B,130C 'unauthor':64B,122C 'user':11A,45B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer with the SSH interface reachable by authenticated low-privileged accounts. NVD says exploitation needs preconditions outside the attacker's control; they are not described in the sources we could read, and affected versions are not published in a source we could read yet. Teams without Fabric Composer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hpe","infrastructure","networkingfabriccomposer","ssh"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95747","severity":null,"published_at":"2026-11-03T20:18:23+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95747:1539","url":null,"severity":null,"published_at":"2026-11-03T20:55:10+00:00","modified_at":"2026-11-03T20:55:10+00:00","first_seen_at":"2026-11-03T20:55:10+00:00","fetched_at":"2026-11-03T20:55:10+00:00","note":"HPE's Nov 3 2026 Fabric Composer bulletin (follow-up to advance notice HPESBNW05166) not retrievable yet; its page is not on the HPE listing or csaf site. Affected and fixed versions unknown. The Sept 1 bulletin HPESBNW05133 (7.3.3 and below, fixed in 7.3.4) covers other CVEs, so it is not evidence for this one. Nothing verified. Revisit when the bulletin is published. No X search (credits depleted per notes)."}],"documents":[{"id":60648,"url":"https://networkingsupport.hpe.com/notification/security","title":"HPE Networking Security Alerts & Advisories (lists HPESBNW05166 advance notice for Nov 3, 2026: VIA, Fabric Composer)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":60651,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95747","title":"NVD CVE-2026-95747","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}