{"id":"CVE-2026-95734","aliases":[],"cve":{"records":[{"id":"CVE-2026-95734","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:19.665Z","published":"2026-11-03T19:50:52.110Z","modified":"2026-11-09T12:22:16.737Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:52.110Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:22:16.737Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:22:00.499064Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API","titleSource":"hpe","descriptionSource":"hpe","description":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","score":8.8,"severity":"high","published":"2026-11-03T19:50:52.110Z","modified":"2026-11-09T12:22:16.737Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95734"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95734","modified":"2026-11-09T12:22:16.737Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95734"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-11-09T12:31:08.650Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:40:32.870Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:35:37.162Z","attemptedAt":"2026-11-09T12:35:37.162Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:35:37.582Z","attemptedAt":"2026-11-09T12:35:37.582Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:35:37.941Z","attemptedAt":"2026-11-09T12:35:37.941Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:35:36.937Z","attemptedAt":"2026-11-09T12:35:36.937Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95734","url":"https://www.first.org/epss/","probability":0.00358,"percentile":0.29806,"date":"2026-11-08","checkedAt":"2026-11-09T12:35:36.937Z"},{"source":"NVD","id":"CVE-2026-95734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95734","modified":"2026-11-03T20:30:24.880","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:37.162Z"},{"source":"GitHub Advisory Database","id":"GHSA-xpv9-6xqp-8xqh","url":"https://github.com/advisories/GHSA-xpv9-6xqp-8xqh","modified":"2026-11-03T21:32:22Z","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:37.582Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116278","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116278","modified":"Nov 3, 2026, 7:50:52 PM","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:37.941Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer API versions 7.0.0 to 7.4.0 have a sensitive information disclosure vulnerability, allowing authenticated low-privileged users to access sensitive information. An attacker with existing access could obtain sensitive credentials.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:36:02.234Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95734"}]}}