---
id: "CVE-2026-95756"
kind: "vulnerability"
aliases: ["CVE-2026-95756"]
title: "HPE Networking Fabric Composer: API command injection lets admins escalate to the OS"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hpe", "infrastructure", "network-management", "networking-fabric-composer"]
not_affected_if: ["no-admin-access-exposure", "product-not-deployed"]
published_at: "2026-11-03T20:18:24+00:00"
first_seen_at: "2026-11-03T20:49:26+00:00"
updated_at: "2026-11-03T20:50:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95756", "first_seen_at": "2026-11-03T20:49:26+00:00"}]
---

# HPE Networking Fabric Composer: API command injection lets admins escalate to the OS

A command injection flaw in the API of HPE Networking Fabric Composer lets an authenticated administrator run commands on the underlying operating system. Successful exploitation can grant elevated privileges on the host, but only when preconditions outside the attacker's control are met.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether HPE Networking Fabric Composer is deployed in your environment and which version is installed, using the product's own version page or package manager.
- Review the HPE advisory referenced by NVD for the affected version ranges, since the sources here do not list them.

## Timeline

- 2026-11-03T20:49:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95756

## From the sources

A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_