{"id":"CVE-2026-95746","aliases":[],"cve":{"records":[{"id":"CVE-2026-95746","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:35.472Z","published":"2026-11-03T19:51:02.930Z","modified":"2026-11-09T18:41:37.548Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:02.930Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T18:41:37.548Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-287","description":"CWE-287 Improper Authentication","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T18:40:22.027896Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authentication Bypass in the API Endpoint of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","score":7.5,"severity":"high","published":"2026-11-03T19:51:02.930Z","modified":"2026-11-09T18:41:37.548Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95746"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95746","modified":"2026-11-09T18:41:37.548Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95746"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-09T19:22:27.050Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:20:35.853Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T04:10:37.819Z","attemptedAt":"2026-11-10T04:10:37.819Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-10T04:10:33.286Z","attemptedAt":"2026-11-10T04:10:33.286Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T04:10:34.151Z","attemptedAt":"2026-11-10T04:10:34.151Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-10T04:10:32.838Z","attemptedAt":"2026-11-10T04:10:32.838Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95746","url":"https://www.first.org/epss/","probability":0.00212,"percentile":0.11486,"date":"2026-11-09","checkedAt":"2026-11-10T04:10:32.838Z"},{"source":"GitHub Advisory Database","id":"GHSA-3w7f-4x3p-62q2","url":"https://github.com/advisories/GHSA-3w7f-4x3p-62q2","modified":"2026-11-09T21:31:39Z","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-10T04:10:33.286Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116163","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116163","modified":"Nov 9, 2026, 6:41:37 PM","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-10T04:10:34.151Z"},{"source":"NVD","id":"CVE-2026-95746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95746","modified":"2026-11-09T19:17:06.487","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-10T04:10:37.819Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an authentication bypass vulnerability, potentially allowing an unauthenticated adjacent attacker to gain unauthorized access if certain preconditions are met. The weakness is due to improper authentication. Successful exploitation could lead to unauthorized system access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T20:11:13.267Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95746"}]}}