{"id":"CVE-2026-95747","aliases":[],"cve":{"records":[{"id":"CVE-2026-95747","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:35.472Z","published":"2026-11-03T19:51:04.409Z","modified":"2026-11-09T17:48:38.324Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:04.409Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T17:48:38.324Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-269","description":"CWE-269 Improper Privilege Management","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T17:48:34.892901Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.","score":7.5,"severity":"high","published":"2026-11-03T19:51:04.409Z","modified":"2026-11-09T17:48:38.324Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95747"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95747","modified":"2026-11-09T17:48:38.324Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95747"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-09T18:15:52.794Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:00:32.916Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T18:20:36.476Z","attemptedAt":"2026-11-09T18:20:36.476Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T18:20:36.549Z","attemptedAt":"2026-11-09T18:20:36.549Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T18:20:36.489Z","attemptedAt":"2026-11-09T18:20:36.489Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T18:20:36.555Z","attemptedAt":"2026-11-09T18:20:36.555Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95747","modified":"2026-11-09T18:17:35.720","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T18:20:36.476Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116164","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116164","modified":"Nov 3, 2026, 7:51:04 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T18:20:36.489Z"},{"source":"GitHub Advisory Database","id":"GHSA-8877-h427-gw75","url":"https://github.com/advisories/GHSA-8877-h427-gw75","modified":"2026-11-03T21:32:22Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T18:20:36.549Z"},{"source":"FIRST EPSS","id":"CVE-2026-95747","url":"https://www.first.org/epss/","probability":0.0027,"percentile":0.19251,"date":"2026-11-09","checkedAt":"2026-11-09T18:20:36.555Z"}],"aiSummary":{"text":"A privilege escalation vulnerability in HPE Networking Fabric Composer's SSH interface could allow an authenticated, low-privileged attacker to exceed their access level if certain conditions are met. This could grant unauthorized access to internal services. Affected versions are 7.0.0 to 7.4.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T18:16:08.894Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95747"}]}}