{"id":"CVE-2026-95749","kind":"vulnerability","aliases":["CVE-2026-95749"],"related":[],"title":"HPE Networking Fabric Composer: missing integrity check lets remote attackers run code","description":"A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.","summary":"HPE Networking Fabric Composer does not verify the integrity of some data it accepts. A remote attacker with no account can exploit this to execute arbitrary code on the affected system.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":[],"how_to_check":"Check your HPE Networking Fabric Composer version in the admin UI. HPE's September advisory (HPESBNW05133, a different set of CVEs) fixed 7.3.4 and 7.4.0; whether those versions also fix this CVE is unconfirmed.","fix":null,"status":"open","published_at":"2026-11-03T20:18:23+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","triaged_at":"2026-11-03T20:50:05+00:00","updated_at":"2026-11-03T20:55:11+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: missing integrity check lets remote attackers run code","impact":"high","summary":"HPE Networking Fabric Composer does not verify the integrity of some data it accepts. A remote attacker with no account can exploit this to execute arbitrary code on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","networking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated remote attacker executes arbitrary code on the system","analyst_note":"Find the HPE advisory for CVE-2026-95749 to get affected versions, fixed versions and whether the issue is internet-facing.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not list affected versions or the specific component or configuration that exposes the flaw. Teams running HPE Networking Fabric Composer should treat it as exposed until the vendor advisory confirms otherwise.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":4083,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE advisory for CVE-2026-95749 to get affected versions, fixed versions and whether the issue is internet-facing.","search":"'-2026':14A,17A '-95749':15A,18A 'accept':38B 'account':44B 'affect':54B,81C 'allow':70C 'arbitrari':50B,77C 'attack':10A,41B,74C 'check':7A 'code':12A,51B,78C 'compos':4A,21B,28B,66C 'could':69C 'cve':13A,16A 'data':36B 'execut':49B,76C 'exist':61C 'exploit':46B,68C 'fabric':3A,20B,27B,65C 'fabric-compos':19B 'hpe':1A,22B,25B,63C 'infrastructur':23B 'integr':6A,33B,58C 'let':8A 'miss':5A,57C 'network':2A,24B,26B,64C 'remot':9A,40B,73C 'run':11A 'success':67C 'system':55B,82C 'unauthent':72C 'verif':59C 'verifi':31B 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"The sources do not list affected versions or the specific component or configuration that exposes the flaw. Teams running HPE Networking Fabric Composer should treat it as exposed until the vendor advisory confirms otherwise.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","high","hpe","infrastructure","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95749","severity":null,"published_at":"2026-11-03T20:18:23+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:25+00:00","fetched_at":"2026-11-03T20:49:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95749:1537","url":null,"severity":null,"published_at":"2026-11-03T20:55:11+00:00","modified_at":"2026-11-03T20:55:11+00:00","first_seen_at":"2026-11-03T20:55:11+00:00","fetched_at":"2026-11-03T20:55:11+00:00","note":"HPE's CVE-2026-95749 bulletin is not yet indexed. HPE's Oct 27 notice HPESBNW05166 says Fabric Composer advisories ship Nov 3 but gives no details (linked as mentions). The Sept advisory HPESBNW05133 (affects <=7.3.3, fixed 7.3.4/7.4.0) was read in part, and this CVE did not appear in the part I read. No affected versions, fix or internet-facing facts confirmed, nothing verified. Recheck once the Nov 3 HPE advisory appears; the CVSS vector in NVD (AV:N/AC:H/PR:N/UI:R) shows user interaction is required and complexity is high."}],"documents":[{"id":60637,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05166en_us&docLocale=en_US","title":"HPESBNW05166 rev.1 - HPE Networking Advance Notification of Security Advisories for November 03, 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}