Live › vulnerability › CVE-2026-95748
HPE Networking Fabric Composer has a SQL injection flaw that lets an attacker send crafted input that is run as database commands. The attacker needs no account and must be on an adjacent network segment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Anyone running HPE Networking Fabric Composer 7.4.0 or below, or 7.3.4 or below, to manage data centre switch fabrics. The attacker needs no account but must be on an adjacent network segment as the management interfaces, and HPE rates attack complexity high. Teams that do not run Fabric Composer can skip it; end-of-support versions should be treated as potentially affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| fabric-composer | vendor | <= 7.3.4, <= 7.4.0 | 7.3.5, 7.4.1 |
7.4.0 and below, and and below, are affected; fixed in 7.4.1+ and 7.3.5+7.3.4Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x); download from the HPE Networking Support Portal.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.
This page as .md · .json · in your agent: get_signal("CVE-2026-95748")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.