---
id: "CVE-2026-95750"
kind: "vulnerability"
aliases: ["CVE-2026-95750"]
title: "HPE Networking Fabric Composer: improper certificate validation exposes credentials to attackers"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fabric-composer", "hpe", "infrastructure", "networking"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T20:18:23+00:00"
first_seen_at: "2026-11-03T20:49:26+00:00"
updated_at: "2026-11-03T20:52:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95750", "first_seen_at": "2026-11-03T20:49:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T20:52:48+00:00"}]
---

# HPE Networking Fabric Composer: improper certificate validation exposes credentials to attackers

HPE Networking Fabric Composer does not properly validate certificates, so a remote attacker can get sensitive information, including credentials, when certain conditions outside their control are met. The attack needs no login, according to the NVD description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown for this CVE. Also check your Fabric Composer version: the Sep 2026 bulletin HPESBNW05133 lists 7.3.3 and below as affected, with 7.3.4 and 7.4.0 as fixed releases for other CVEs. Confirm against HPE's Nov 3 2026 bulletin before relying on those numbers.

## Timeline

- 2026-11-03T20:49:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95750
- 2026-11-03T20:52:48+00:00 analyst — HPE's bulletin naming CVE-2026-95750 not found. The Nov 3 2026 advisory is only previewed in HPESBNW05166 (advance notice, no CVEs or versions), and the full text was not retrievable. The Sep bulletin HPESBNW05133 (Fabric Composer 7.3.3 and below, fixed 7.3.4 / 7.4.0) does not list this CVE in the part I could read (it was truncated). Nothing verified; versions and fix unknown. Settle by reading HPE's Nov 3 Fabric Composer bulletin.

## Documents

- [mentions] HPESBNW05166 rev.1 - HPE Networking Advance Notification of Security Advisories for November 03, 2026 https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05166en_us&docLocale=en_US
- [mentions] HPESBNW05133 Multiple Vulnerabilities in HPE Networking Fabric Composer (Sep 2026, earlier bulletin; does not list CVE-2026-95742 in the part I could read) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05133.txt

## From the sources

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_