{"id":"CVE-2026-95738","aliases":[],"cve":{"records":[{"id":"CVE-2026-95738","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:19.666Z","published":"2026-11-03T19:50:55.066Z","modified":"2026-11-09T12:34:34.438Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:55.066Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:34:34.438Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-287","description":"CWE-287 Improper Authentication","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:33:13.843062Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","score":8.1,"severity":"high","published":"2026-11-03T19:50:55.066Z","modified":"2026-11-09T12:34:34.438Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95738"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95738","modified":"2026-11-09T12:34:34.438Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95738"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"sourceAffected":[],"observedAt":"2026-11-09T12:40:45.183Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:45:36.175Z","attemptedAt":"2026-11-09T12:45:36.175Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:45:35.839Z","attemptedAt":"2026-11-09T12:45:35.839Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:45:36.734Z","attemptedAt":"2026-11-09T12:45:36.734Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:45:35.748Z","attemptedAt":"2026-11-09T12:45:35.748Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95738","url":"https://www.first.org/epss/","probability":0.00453,"percentile":0.39566,"date":"2026-11-08","checkedAt":"2026-11-09T12:45:35.748Z"},{"source":"GitHub Advisory Database","id":"GHSA-674v-9495-q76v","url":"https://github.com/advisories/GHSA-674v-9495-q76v","modified":"2026-11-03T21:32:21Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:45:35.839Z"},{"source":"NVD","id":"CVE-2026-95738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95738","modified":"2026-11-03T20:30:24.880","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:45:36.175Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116282","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116282","modified":"Nov 3, 2026, 7:50:55 PM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:45:36.734Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an authentication bypass vulnerability, potentially allowing an unauthenticated remote attacker to gain administrative access under certain conditions. The attacker must meet preconditions outside of their control. Successful exploitation could grant administrative access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:41:02.220Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95738"}]}}