{"id":"CVE-2026-95732","aliases":[],"cve":{"records":[{"id":"CVE-2026-95732","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:52:25.204Z","published":"2026-11-03T19:50:50.725Z","modified":"2026-11-09T12:19:00.830Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:50.725Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:19:00.830Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-287","description":"CWE-287 Improper Authentication","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:18:53.439970Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution","titleSource":"hpe","descriptionSource":"hpe","description":"An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","score":9.6,"severity":"critical","published":"2026-11-03T19:50:50.725Z","modified":"2026-11-09T12:19:00.830Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95732"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95732","modified":"2026-11-09T12:19:00.830Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95732"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.6}],"sourceAffected":[],"observedAt":"2026-11-09T12:31:05.710Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:40:33.160Z","attemptedAt":"2026-11-09T12:40:33.160Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:40:33.446Z","attemptedAt":"2026-11-09T12:40:33.446Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:40:33.048Z","attemptedAt":"2026-11-09T12:40:33.048Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:40:34.134Z","attemptedAt":"2026-11-09T12:40:34.134Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-116276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116276","modified":"Nov 3, 2026, 7:50:50 PM","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:40:33.048Z"},{"source":"NVD","id":"CVE-2026-95732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95732","modified":"2026-11-03T20:30:24.880","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:40:33.160Z"},{"source":"GitHub Advisory Database","id":"GHSA-rm95-25cq-jcrp","url":"https://github.com/advisories/GHSA-rm95-25cq-jcrp","modified":"2026-11-03T21:32:21Z","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:40:33.446Z"},{"source":"FIRST EPSS","id":"CVE-2026-95732","url":"https://www.first.org/epss/","probability":0.0029,"percentile":0.21664,"date":"2026-11-08","checkedAt":"2026-11-09T12:40:34.134Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an authentication bypass vulnerability, potentially allowing an adjacent attacker to execute arbitrary code. The weakness is due to improper authentication. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:36:03.538Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95732"}]}}