{"id":"CVE-2026-95735","aliases":[],"cve":{"records":[{"id":"CVE-2026-95735","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:19.666Z","published":"2026-11-03T19:50:52.845Z","modified":"2026-11-09T12:24:02.813Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:52.845Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:24:02.813Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:23:09.927551Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper Certificate Validation in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.","score":8.7,"severity":"high","published":"2026-11-03T19:50:52.845Z","modified":"2026-11-09T12:24:02.813Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95735"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95735","modified":"2026-11-09T12:24:02.813Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95735"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-11-09T12:31:10.219Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:35:35.857Z","attemptedAt":"2026-11-09T12:35:35.857Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:35:36.245Z","attemptedAt":"2026-11-09T12:35:36.245Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:35:36.386Z","attemptedAt":"2026-11-09T12:35:36.386Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:35:35.899Z","attemptedAt":"2026-11-09T12:35:35.899Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95735","modified":"2026-11-03T20:30:24.880","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:35:35.857Z"},{"source":"FIRST EPSS","id":"CVE-2026-95735","url":"https://www.first.org/epss/","probability":0.00223,"percentile":0.1295,"date":"2026-11-08","checkedAt":"2026-11-09T12:35:35.899Z"},{"source":"GitHub Advisory Database","id":"GHSA-rm74-m4w2-m7w8","url":"https://github.com/advisories/GHSA-rm74-m4w2-m7w8","modified":"2026-11-03T21:32:21Z","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:35:36.245Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116279","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116279","modified":"Nov 3, 2026, 7:50:52 PM","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:35:36.386Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an improper certificate validation weakness, potentially allowing an unauthenticated remote attacker to obtain sensitive information under certain preconditions. The attacker requires no access to the system. The impact is limited to obtaining sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:36:03.201Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95735"}]}}