{"id":"CVE-2026-95748","kind":"vulnerability","aliases":["CVE-2026-95748"],"related":[],"title":"HPE Networking Fabric Composer: SQL injection lets an attacker run database commands","description":"A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.","summary":"HPE Networking Fabric Composer has a SQL injection flaw that lets an attacker send crafted input that is run as database commands. The attacker needs no account and must be on an adjacent network segment.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fabric-composer","fixed":["7.3.5","7.4.1"],"affected":"<= 7.3.4, <= 7.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","network-management","networking-fabric-composer","self-hosted"],"not_affected_if":["no-fabric-composer","not-installed"],"how_to_check":"Check the installed Fabric Composer version: 7.4.0 and below, and 7.3.4 and below, are affected; fixed in 7.4.1+ and 7.3.5+. Versions past End of Maintenance/Support are presumed affected. Until patched, HPE recommends restricting the CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall policies at layer 3 and above, with accounting controls.","fix":"Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x) or 7.3.5 or later (7.3.x); download from the HPE Networking Support Portal.","status":"open","published_at":"2026-11-03T20:18:23+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:50:07+00:00","updated_at":"2026-11-03T20:55:01+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T20:50:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: SQL injection lets an attacker run database commands","impact":"high","summary":"HPE Networking Fabric Composer has a SQL injection flaw that lets an attacker send crafted input that is run as database commands. The attacker needs no account and must be on an adjacent network segment.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","network-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs arbitrary database commands on the Fabric Composer backend","analyst_note":"Find the HPE advisory for affected versions and fixes; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-95748 gives no version or fix details.","how_to_check":"- Check whether HPE Networking Fabric Composer is installed in your environment\n- Review the vendor advisory for the affected versions (unknown from these sources)","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Teams running HPE Networking Fabric Composer on a network segment that an attacker could reach. The sources do not list affected versions or configuration details.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4077,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE advisory for affected versions and fixes; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-95748 gives no version or fix details.","search":"'-2026':14A,17A '-95748':15A,18A 'account':63B 'adjac':69B,88C 'allow':85C 'arbitrari':92C 'attack':9A,49B,60B,89C 'command':12A,58B,94C 'compos':4A,24B,33B,40B,81C 'composer':21A 'could':84C 'craft':51B 'cve':13A,16A 'databas':11A,57B,93C 'exist':76C 'exploit':83C 'fabric':3A,20A,23B,32B,39B,80C 'fabric-compos':22B 'fabric-composer':19A 'flaw':45B 'host':36B 'hpe':1A,25B,37B,78C 'infrastructur':26B 'inject':6A,44B,74C 'input':52B 'let':7A,47B 'manag':29B 'must':65B 'need':61B 'network':2A,28B,31B,38B,70B,79C 'network-manag':27B 'networking-fabric-compos':30B 'run':10A,55B,91C 'segment':71B 'self':35B 'self-host':34B 'send':50B 'sql':5A,43B,73C 'success':82C 'unauthent':87C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE Networking Fabric Composer 7.4.0 or below, or 7.3.4 or below, to manage data centre switch fabrics. The attacker needs no account but must be on an adjacent network segment as the management interfaces, and HPE rates attack complexity high. Teams that do not run Fabric Composer can skip it; end-of-support versions should be treated as potentially affected.","tier":"B","verified":{"fix":{"at":"2026-11-03T20:55:01Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1538},"products":{"at":"2026-11-03T20:55:01Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1538},"how_to_check":{"at":"2026-11-03T20:55:01Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1538},"who_affected":{"at":"2026-11-03T20:55:01Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1538}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fabriccomposer"],"ptokens":["composer","fabric"],"labels":["fabriccomposer","high","hpe","infrastructure","networkingfabriccomposer","networkmanagement","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95748","severity":null,"published_at":"2026-11-03T20:18:23+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95748:1538","url":null,"severity":null,"published_at":"2026-11-03T20:55:01+00:00","modified_at":"2026-11-03T20:55:01+00:00","first_seen_at":"2026-11-03T20:55:01+00:00","fetched_at":"2026-11-03T20:55:01+00:00","note":"Read HPE HPESBNW05172 (2026-11-03): affected 7.4.0 and below, 7.3.4 and below; fixed 7.4.1+ / 7.3.5+. Entry 95748 read via WebFetch summary (CVSS 7.5, AV:A/AC:H/PR:N, VULN-1018). HPE not aware of public discussion or exploit. No posts checked, just published."}],"documents":[{"id":60639,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","title":"HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}