{"id":"CVE-2026-95750","kind":"vulnerability","aliases":["CVE-2026-95750"],"related":[],"title":"HPE Networking Fabric Composer: improper certificate validation exposes credentials to attackers","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.","summary":"HPE Networking Fabric Composer does not properly validate certificates, so a remote attacker can get sensitive information, including credentials, when certain conditions outside their control are met. The attack needs no login, according to the NVD description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":["unknown"],"how_to_check":"Unknown for this CVE. Also check your Fabric Composer version: the Sep 2026 bulletin HPESBNW05133 lists 7.3.3 and below as affected, with 7.3.4 and 7.4.0 as fixed releases for other CVEs. Confirm against HPE's Nov 3 2026 bulletin before relying on those numbers.","fix":null,"status":"open","published_at":"2026-11-03T20:18:23+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:05+00:00","updated_at":"2026-11-03T20:52:48+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-03T20:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: improper certificate validation exposes credentials to attackers","impact":"high","summary":"HPE Networking Fabric Composer does not properly validate certificates, so a remote attacker can get sensitive information, including credentials, when certain conditions outside their control are met. The attack needs no login, according to the NVD description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking","fabric-composer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker obtains sensitive information including credentials from the product","analyst_note":"Find the HPE security bulletin for CVE-2026-95750 to get affected versions, the fixed release and the exact preconditions for exploitation.","how_to_check":"- Confirm whether HPE Networking Fabric Composer is installed and which version runs (version not stated in the sources, so unknown).\n- Check the HPE advisory for the affected version ranges (unknown in the sources).","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run HPE Networking Fabric Composer in their network fabric. The sources do not name the exact versions or configurations that are exposed, nor the preconditions that must hold, so whether a given deployment is at risk is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":4122,"output_tokens":526,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE security bulletin for CVE-2026-95750 to get affected versions, the fixed release and the exact preconditions for exploitation.","search":"'-2026':13A,16A '-95750':14A,17A 'access':78C 'accord':56B 'allow':72C,95C 'attack':11A,36B,52B,76C,87C,97C 'certain':44B,82C 'certif':6A,32B,63C 'compos':4A,20B,27B,70C 'condit':45B 'control':48B,89C 'could':71C,94C 'credenti':9A,42B,103C 'cve':12A,15A 'descript':60B 'exploit':93C 'expos':8A 'fabric':3A,19B,26B,69C 'fabric-compos':18B 'get':38B 'hpe':1A,21B,24B,67C 'improp':5A,62C 'includ':41B,102C 'inform':40B,80C,101C 'infrastructur':22B 'login':55B 'met':50B,91C 'need':53B 'network':2A,23B,25B,68C 'nvd':59B 'obtain':99C 'outsid':46B,84C 'precondit':83C 'proper':30B 'remot':35B,75C 'sensit':39B,79C,100C 'success':92C 'unauthent':74C 'valid':7A,31B,64C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer. NVD says no login is needed, but certain conditions outside the attacker's control must be met. Affected versions are not confirmed by any HPE page I could read. Teams without Fabric Composer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","high","hpe","infrastructure","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95750","severity":null,"published_at":"2026-11-03T20:18:23+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95750:1536","url":null,"severity":null,"published_at":"2026-11-03T20:52:48+00:00","modified_at":"2026-11-03T20:52:48+00:00","first_seen_at":"2026-11-03T20:52:48+00:00","fetched_at":"2026-11-03T20:52:48+00:00","note":"HPE's bulletin naming CVE-2026-95750 not found. The Nov 3 2026 advisory is only previewed in HPESBNW05166 (advance notice, no CVEs or versions), and the full text was not retrievable. The Sep bulletin HPESBNW05133 (Fabric Composer 7.3.3 and below, fixed 7.3.4 / 7.4.0) does not list this CVE in the part I could read (it was truncated). Nothing verified; versions and fix unknown. Settle by reading HPE's Nov 3 Fabric Composer bulletin."}],"documents":[{"id":60637,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05166en_us&docLocale=en_US","title":"HPESBNW05166 rev.1 - HPE Networking Advance Notification of Security Advisories for November 03, 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":60632,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt","title":"HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}