{"id":"CVE-2026-95736","aliases":[],"cve":{"records":[{"id":"CVE-2026-95736","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:19.666Z","published":"2026-11-03T19:50:53.587Z","modified":"2026-11-09T12:25:04.654Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:53.587Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:25:04.654Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:24:22.079874Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.","score":8.3,"severity":"high","published":"2026-11-03T19:50:53.587Z","modified":"2026-11-09T12:25:04.654Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95736"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95736","modified":"2026-11-09T12:25:04.654Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95736"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","score":8.3}],"sourceAffected":[],"observedAt":"2026-11-09T12:31:11.663Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:35:34.673Z","attemptedAt":"2026-11-09T12:35:34.673Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:35:34.881Z","attemptedAt":"2026-11-09T12:35:34.881Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:35:35.090Z","attemptedAt":"2026-11-09T12:35:35.090Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:35:34.621Z","attemptedAt":"2026-11-09T12:35:34.621Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95736","url":"https://www.first.org/epss/","probability":0.00102,"percentile":0.00919,"date":"2026-11-08","checkedAt":"2026-11-09T12:35:34.621Z"},{"source":"NVD","id":"CVE-2026-95736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95736","modified":"2026-11-03T20:30:24.880","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:34.673Z"},{"source":"GitHub Advisory Database","id":"GHSA-c4rp-565m-whvq","url":"https://github.com/advisories/GHSA-c4rp-565m-whvq","modified":"2026-11-03T21:32:21Z","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:34.881Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116280","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116280","modified":"Nov 3, 2026, 7:50:53 PM","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-09T12:35:35.090Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an improper certificate validation vulnerability, which an unauthenticated adjacent attacker may exploit under certain conditions to intercept sensitive information. The weakness is due to improper certificate validation. Successful exploitation requires specific preconditions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:36:01.823Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95736"}]}}