{"id":"CVE-2026-95740","aliases":[],"cve":{"records":[{"id":"CVE-2026-95740","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:19.666Z","published":"2026-11-03T19:50:56.678Z","modified":"2026-11-09T12:40:09.498Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:56.678Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:40:09.498Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:39:37.779844Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","score":8,"severity":"high","published":"2026-11-03T19:50:56.678Z","modified":"2026-11-09T12:40:09.498Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95740"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95740","modified":"2026-11-09T12:40:09.498Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95740"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8}],"sourceAffected":[],"observedAt":"2026-11-09T12:45:45.570Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:50:33.395Z","attemptedAt":"2026-11-09T12:50:33.395Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:50:33.477Z","attemptedAt":"2026-11-09T12:50:33.477Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:50:33.139Z","attemptedAt":"2026-11-09T12:50:33.139Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:50:32.948Z","attemptedAt":"2026-11-09T12:50:32.948Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95740","url":"https://www.first.org/epss/","probability":0.00096,"percentile":0.0066,"date":"2026-11-08","checkedAt":"2026-11-09T12:50:32.948Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116284","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116284","modified":"Nov 3, 2026, 7:50:56 PM","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:50:33.139Z"},{"source":"NVD","id":"CVE-2026-95740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95740","modified":"2026-11-03T20:30:24.880","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:50:33.395Z"},{"source":"GitHub Advisory Database","id":"GHSA-6pvr-mwh2-m5rm","url":"https://github.com/advisories/GHSA-6pvr-mwh2-m5rm","modified":"2026-11-03T21:32:21Z","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-09T12:50:33.477Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an improper certificate validation vulnerability, allowing an unauthenticated adjacent attacker to intercept communications and obtain sensitive information under certain conditions. The attacker must be adjacent to the affected system. Successful exploitation could lead to information disclosure.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:46:02.439Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95740"}]}}