---
id: "CVE-2026-95747"
kind: "vulnerability"
aliases: ["CVE-2026-95747"]
title: "HPE Networking Fabric Composer: SSH flaw lets low-privilege users gain higher access"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hpe", "infrastructure", "networking-fabric-composer", "ssh"]
not_affected_if: ["not-deployed", "ssh-disabled"]
published_at: "2026-11-03T20:18:23+00:00"
first_seen_at: "2026-11-03T20:49:25+00:00"
updated_at: "2026-11-03T20:55:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95747", "first_seen_at": "2026-11-03T20:49:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:55:10+00:00"}]
---

# HPE Networking Fabric Composer: SSH flaw lets low-privilege users gain higher access

A flaw in the SSH interface of HPE Networking Fabric Composer lets an authenticated low-privileged user exceed their authorized access level when certain preconditions outside the attacker's control are met. Successful exploitation gives unauthorized access to internal services of the affected system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether HPE Networking Fabric Composer is deployed and its SSH interface is reachable by low-privileged accounts
- Read the Nov 3 2026 HPE Networking Fabric Composer bulletin on networkingsupport.hpe.com/notification/security for affected and fixed versions (not yet read by us)
- Fabric Composer 7.3.3 and below was affected by other CVEs in HPESBNW05133 (Sept 2026); check the installed version anyway and apply the latest release

## Timeline

- 2026-11-03T20:49:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95747
- 2026-11-03T20:55:10+00:00 analyst — HPE's Nov 3 2026 Fabric Composer bulletin (follow-up to advance notice HPESBNW05166) not retrievable yet; its page is not on the HPE listing or csaf site. Affected and fixed versions unknown. The Sept 1 bulletin HPESBNW05133 (7.3.3 and below, fixed in 7.3.4) covers other CVEs, so it is not evidence for this one. Nothing verified. Revisit when the bulletin is published. No X search (credits depleted per notes).

## Documents

- [describes] NVD CVE-2026-95747 https://nvd.nist.gov/vuln/detail/CVE-2026-95747
- [mentions] HPE Networking Security Alerts & Advisories (lists HPESBNW05166 advance notice for Nov 3, 2026: VIA, Fabric Composer) https://networkingsupport.hpe.com/notification/security

## From the sources

A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_