{"id":"CVE-2026-95772","kind":"vulnerability","aliases":["CVE-2026-95772"],"related":[],"title":"HPE Networking Fabric Composer: API race condition lets low-privilege users corrupt configuration","description":"A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.","summary":"A race condition in the API of HPE Networking Fabric Composer can be exploited by an authenticated attacker with low privileges. Successful exploitation corrupts the configuration state of the affected system.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpe-networking-fabric-composer","infrastructure","network-fabric"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T20:18:26+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","triaged_at":"2026-11-03T20:51:58+00:00","updated_at":"2026-11-03T20:51:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:51:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HPE Networking Fabric Composer: API race condition lets low-privilege users corrupt configuration","impact":"medium","summary":"A race condition in the API of HPE Networking Fabric Composer can be exploited by an authenticated attacker with low privileges. Successful exploitation corrupts the configuration state of the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-networking-fabric-composer","network-fabric"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker corrupts the system's configuration state through the API","analyst_note":"Find affected versions, fixed releases and checks in HPE's security bulletin for this CVE; the NVD entry alone gives none.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run HPE Networking Fabric Composer and expose its API to users with low-privilege accounts. Who can skip it: unknown, the sources do not name affected versions or configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":4084,"output_tokens":431,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-95772':17A,20A 'affect':59B,91C 'allow':77C 'api':5A,35B,68C 'attack':47B,80C 'authent':46B,79C 'compos':4A,25B,40B,73C 'condit':7A,32B,63C 'configur':14A,55B,87C 'corrupt':13A,53B,85C 'could':76C 'cve':15A,18A 'exist':65C 'exploit':43B,52B,75C 'fabric':3A,24B,29B,39B,72C 'hpe':1A,22B,37B,70C 'hpe-networking-fabric-compos':21B 'infrastructur':26B 'let':8A 'low':10A,49B,82C 'low-privileg':9A 'network':2A,23B,28B,38B,71C 'network-fabr':27B 'privileg':11A,50B,83C 'race':6A,31B,62C 'state':56B,88C 'success':51B,74C 'system':60B,92C 'user':12A 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HPE Networking Fabric Composer and expose its API to users with low-privilege accounts. Who can skip it: unknown, the sources do not name affected versions or configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpenetworkingfabriccomposer","infrastructure","medium","networkfabric"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95772","severity":null,"published_at":"2026-11-03T20:18:26+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","fetched_at":"2026-11-03T20:49:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}