{"id":"CVE-2026-95753","kind":"vulnerability","aliases":["CVE-2026-95753"],"related":[],"title":"HPE Fabric Composer API flaw lets a low-privilege user view network traffic from managed switches","description":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.","summary":"CVE-2026-95753 (CVSS 7.1) is a flaw in the HPE Networking Fabric Composer API. An authenticated attacker with low privileges could view network traffic from switches that Fabric Composer manages. HPE found it internally and is not aware of public discussion or exploit code. Fixed in 7.4.1 and 7.3.5.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fabric-composer","fixed":["7.3.5","7.4.1"],"affected":"<= 7.3.4, <= 7.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","network-switches","self-hosted"],"not_affected_if":["auth-required","no-fabric-composer"],"how_to_check":"Check the installed Fabric Composer version. Versions 7.4.0 and below, and 7.3.4 and below, are affected; fixed in 7.4.1+ and 7.3.5+. Releases past End of Maintenance/Support are presumed affected. Until patched, HPE recommends restricting CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall policies at layer 3 and above, with accounting controls logging user activity.","fix":"Upgrade HPE Networking Fabric Composer to 7.4.1 or later (7.4.x branch) or 7.3.5 or later (7.3.x branch); download from the HPE Networking Support Portal.","status":"open","published_at":"2026-11-03T20:18:23+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:18+00:00","updated_at":"2026-11-03T20:53:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T20:50:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Fabric Composer API flaw lets low-privilege users read switch traffic","impact":"medium","summary":"HPE Networking Fabric Composer has a privilege escalation flaw in its API. An authenticated attacker with low privileges could disclose network traffic from switches the product manages.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","fabric-composer","network-switches"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads network traffic from managed switches","analyst_note":"Find affected version ranges and the fixed release in the HPE security bulletin for CVE-2026-95753; the NVD entry alone gives neither.","how_to_check":"- Confirm whether HPE Networking Fabric Composer is deployed in your network, and note its version.\n- Check the installed version against the fixed release listed in HPE's advisory (unknown in the sources given).","plain_action":"","needs_analyst":true,"not_affected_if":["no-fabric-composer"],"who_is_affected":"Teams that run HPE Networking Fabric Composer to manage switches. Exposure requires a valid low-privilege account on the API. Teams without Fabric Composer can skip it. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4095,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected version ranges and the fixed release in the HPE security bulletin for CVE-2026-95753; the NVD entry alone gives neither.","search":"'-2026':19A,22A,39B '-95753':20A,23A,40B '7.1':42B '7.3.5':87B '7.4.1':85B 'allow':104C 'api':4A,52B,95C 'attack':55B,107C 'authent':54B,106C 'awar':76B 'code':82B 'compos':3A,29B,51B,67B,100C,120C 'composer':26A 'could':59B,103C 'cve':18A,21A,38B 'cvss':41B 'disclos':112C 'discuss':79B 'escal':90C 'exist':92C 'exploit':81B,102C 'fabric':2A,25A,28B,50B,66B,99C,119C 'fabric-compos':27B 'fabric-composer':24A 'fix':83B 'flaw':5A,45B 'found':70B 'host':37B 'hpe':1A,30B,48B,69B,97C 'infrastructur':31B 'intern':72B 'let':6A 'low':9A,57B,109C 'low-privileg':8A 'manag':16A,68B,117C 'network':13A,33B,49B,61B,98C,113C 'network-switch':32B 'privileg':10A,58B,89C,110C 'public':78B 'self':36B 'self-host':35B 'success':101C 'switch':17A,34B,64B,116C 'traffic':14A,62B,114C 'user':11A 'view':12A,60B 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE Networking Fabric Composer (AFC) 7.4.0 or below, or 7.3.4 or below, to manage data centre switch fabrics. The attacker needs a valid low-privilege account and network access to the API. Teams that do not run Fabric Composer can skip it; end-of-support versions should be treated as affected.","tier":"B","verified":{"fix":{"at":"2026-11-03T20:53:28Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1533},"products":{"at":"2026-11-03T20:53:28Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1533},"how_to_check":{"at":"2026-11-03T20:53:28Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1533},"who_affected":{"at":"2026-11-03T20:53:28Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","run_id":1533}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fabriccomposer"],"ptokens":["composer","fabric"],"labels":["fabriccomposer","high","hpe","infrastructure","networkswitches","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95753","severity":null,"published_at":"2026-11-03T20:18:23+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95753:1533","url":null,"severity":null,"published_at":"2026-11-03T20:53:28+00:00","modified_at":"2026-11-03T20:53:28+00:00","first_seen_at":"2026-11-03T20:53:28+00:00","fetched_at":"2026-11-03T20:53:28+00:00","note":"Read HPE advisory HPESBNW05172 (2026-11-03, csaf text; entry for this CVE read via WebFetch summary since web-cli output truncated before it). Affected 7.4.0 and below, 7.3.4 and below; fixed 7.4.1+, 7.3.5+. No exploitation or public PoC known to HPE. No public posts checked (just published). Workaround is only in how-to-check (no workaround flag)."}],"documents":[{"id":60639,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05172.txt","title":"HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer (AFC)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":60641,"url":"https://radar.offseq.com/threat/cve-2026-95753-privilege-escalation-in-hpe-networking-fabric-composer-api-4765688abaf348ab","title":"OffSeq: CVE-2026-95753","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}