{"id":"CVE-2026-95763","kind":"vulnerability","aliases":["CVE-2026-95763"],"related":[],"title":"HPE Networking Fabric Composer: certificate check flaw exposes transferred files and credentials","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept transferred files and the stored credentials for remote servers.","summary":"HPE Networking Fabric Composer does not properly validate certificates, so a network attacker can intercept files it transfers. Stored credentials for remote servers can also be exposed to that attacker.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fabric-composer","hpe","infrastructure","networking"],"not_affected_if":["product-not-deployed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T20:18:25+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","triaged_at":"2026-11-03T20:50:34+00:00","updated_at":"2026-11-03T20:50:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T20:50:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: certificate check flaw exposes transferred files and credentials","impact":"medium","summary":"HPE Networking Fabric Composer does not properly validate certificates, so a network attacker can intercept files it transfers. Stored credentials for remote servers can also be exposed to that attacker.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe","networking","fabric-composer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker intercepts transferred files and stored remote server credentials","analyst_note":"Find the HPE advisory and affected version ranges, and the preconditions required for interception, at https://nvd.nist.gov/vuln/detail/CVE-2026-95763.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-deployed"],"who_is_affected":"Teams running HPE Networking Fabric Composer that transfer files or connect to remote servers. The sources say exploitation depends on preconditions outside the attacker's control, and do not describe those preconditions. Sites that do not run the product can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":4129,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-95763':15A,18A 'access':72C 'allow':66C,89C 'also':49B 'attack':37B,54B,70C,81C,91C 'certain':76C 'certif':5A,33B,57C 'check':6A 'compos':4A,21B,28B,64C 'control':83C 'could':65C,88C 'credenti':12A,44B,99C 'cve':13A,16A 'exploit':87C 'expos':8A,51B 'fabric':3A,20B,27B,63C 'fabric-compos':19B 'file':10A,40B,95C 'flaw':7A 'hpe':1A,22B,25B,61C 'improp':56C 'inform':74C 'infrastructur':23B 'intercept':39B,93C 'met':85C 'network':2A,24B,26B,36B,62C 'outsid':78C 'precondit':77C 'proper':31B 'remot':46B,69C,101C 'sensit':73C 'server':47B,102C 'store':43B,98C 'success':86C 'transfer':9A,42B,94C 'unauthent':68C 'valid':32B,58C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Fabric Composer that transfer files or connect to remote servers. The sources say exploitation depends on preconditions outside the attacker's control, and do not describe those preconditions. Sites that do not run the product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fabriccomposer","hpe","infrastructure","medium","networking"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95763","severity":null,"published_at":"2026-11-03T20:18:25+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:26+00:00","fetched_at":"2026-11-03T20:49:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}