{"id":"CVE-2026-95755","kind":"vulnerability","aliases":["CVE-2026-95755"],"related":[],"title":"HPE Networking Fabric Composer: certificate validation flaw exposes management traffic","description":"Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","summary":"HPE Networking Fabric Composer does not properly validate certificates on an affected interface. An unauthenticated attacker on an adjacent network can intercept management traffic and obtain sensitive information when certain preconditions outside their control are met.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe","infrastructure","network-management","networking-fabric-composer"],"not_affected_if":["not-running-product"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T20:18:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:22+00:00","updated_at":"2026-11-03T20:50:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:50:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: certificate validation flaw exposes management traffic","impact":"medium","summary":"HPE Networking Fabric Composer does not properly validate certificates on an affected interface. An unauthenticated attacker on an adjacent network can intercept management traffic and obtain sensitive information when certain preconditions outside their control are met.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","network-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker intercepts management traffic and obtains sensitive information","analyst_note":"Check the HPE security bulletin for affected versions, the specific interface, the preconditions, and the fixed release; the NVD entry alone gives none of these.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-product"],"who_is_affected":"Organizations running HPE Networking Fabric Composer whose management interface carries traffic that an adjacent-network attacker could reach. The sources do not describe the exact affected interface or versions, and do not say which configurations are needed for the preconditions to hold. Teams not running HPE Networking Fabric Composer can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":4128,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95755':13A,16A 'adjac':44B,79C 'affect':37B,68C 'allow':76C,99C 'attack':41B,80C,91C,101C 'certain':55B,86C 'certif':5A,34B,63C 'compos':4A,25B,29B,74C 'control':59B,93C 'could':75C,98C 'cve':11A,14A 'exploit':97C 'expos':8A 'fabric':3A,24B,28B,73C 'flaw':7A 'hpe':1A,17B,26B,71C 'improp':62C 'inform':53B,105C 'infrastructur':18B 'intercept':47B,82C 'interfac':38B,69C 'manag':9A,21B,48B,83C 'met':61B,95C 'network':2A,20B,23B,27B,45B,72C 'network-manag':19B 'networking-fabric-compos':22B 'obtain':51B,103C 'outsid':57B,88C 'precondit':56B,87C 'proper':32B 'sensit':52B,104C 'success':96C 'traffic':10A,49B,84C 'unauthent':40B,78C 'valid':6A,33B,64C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Organizations running HPE Networking Fabric Composer whose management interface carries traffic that an adjacent-network attacker could reach. The sources do not describe the exact affected interface or versions, and do not say which configurations are needed for the preconditions to hold. Teams not running HPE Networking Fabric Composer can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpe","infrastructure","medium","networkingfabriccomposer","networkmanagement"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95755","severity":null,"published_at":"2026-11-03T20:18:24+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}