{"id":"CVE-2026-95756","kind":"vulnerability","aliases":["CVE-2026-95756"],"related":[],"title":"HPE Networking Fabric Composer: API command injection lets admins escalate to the OS","description":"A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.","summary":"A command injection flaw in the API of HPE Networking Fabric Composer lets an authenticated administrator run commands on the underlying operating system. Successful exploitation can grant elevated privileges on the host, but only when preconditions outside the attacker's control are met.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe","infrastructure","network-management","networking-fabric-composer"],"not_affected_if":["no-admin-access-exposure","product-not-deployed"],"how_to_check":"- Check whether HPE Networking Fabric Composer is deployed in your environment and which version is installed, using the product's own version page or package manager.\n- Review the HPE advisory referenced by NVD for the affected version ranges, since the sources here do not list them.","fix":null,"status":"open","published_at":"2026-11-03T20:18:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:26+00:00","updated_at":"2026-11-03T20:50:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T20:50:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: API command injection lets admins escalate to the OS","impact":"high","summary":"A command injection flaw in the API of HPE Networking Fabric Composer lets an authenticated administrator run commands on the underlying operating system. Successful exploitation can grant elevated privileges on the host, but only when preconditions outside the attacker's control are met.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking-fabric-composer","network-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains elevated privileges on the underlying operating system","analyst_note":"Find the HPE advisory for CVE-2026-95756 to get affected and fixed versions and the preconditions mentioned in the description.","how_to_check":"- Check whether HPE Networking Fabric Composer is deployed in your environment and which version is installed, using the product's own version page or package manager.\n- Review the HPE advisory referenced by NVD for the affected version ranges, since the sources here do not list them.","plain_action":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposure","product-not-deployed"],"who_is_affected":"Teams running HPE Networking Fabric Composer whose API is reachable by administrative accounts. The attacker needs admin-level credentials and certain preconditions the sources do not specify, so exposure depends on who holds admin access and how the API is reached. unknown for affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4128,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-95756':16A,19A 'admin':9A 'administr':44B,95C 'allow':111C 'api':5A,35B,79C 'attack':67B,93C,103C,113C 'authent':43B,91C 'certain':98C 'command':6A,30B,46B,73C 'compos':4A,28B,40B,84C 'control':69B,105C 'could':86C,110C 'cve':14A,17A 'elev':56B,116C 'escal':10A 'exist':76C 'exploit':53B,88C,109C 'fabric':3A,27B,39B,83C 'flaw':32B 'gain':115C 'grant':55B 'host':60B 'hpe':1A,20B,37B,81C 'infrastructur':21B 'inject':7A,31B,74C 'let':8A,41B 'manag':24B 'met':71B,107C 'network':2A,23B,26B,38B,82C 'network-manag':22B 'networking-fabric-compos':25B 'oper':50B,121C 'os':13A 'outsid':65B,100C 'precondit':64B,99C 'privileg':57B,96C,117C 'remot':92C 'run':45B 'success':52B,108C 'system':51B,122C 'under':49B,120C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer whose API is reachable by administrative accounts. The attacker needs admin-level credentials and certain preconditions the sources do not specify, so exposure depends on who holds admin access and how the API is reached. unknown for affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpe","infrastructure","medium","networkingfabriccomposer","networkmanagement"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95756","severity":null,"published_at":"2026-11-03T20:18:24+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}