{"id":"CVE-2026-95748","aliases":[],"cve":{"records":[{"id":"CVE-2026-95748","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:35.472Z","published":"2026-11-03T19:51:05.332Z","modified":"2026-11-09T12:42:17.686Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:05.332Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:42:17.686Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:41:30.652437Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.","score":7.5,"severity":"high","published":"2026-11-03T19:51:05.332Z","modified":"2026-11-09T12:42:17.686Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95748"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95748","modified":"2026-11-09T12:42:17.686Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95748"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-09T12:45:47.213Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:00:32.916Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:50:31.939Z","attemptedAt":"2026-11-09T12:50:31.939Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:50:31.939Z","attemptedAt":"2026-11-09T12:50:31.939Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:50:31.939Z","attemptedAt":"2026-11-09T12:50:31.939Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:50:31.957Z","attemptedAt":"2026-11-09T12:50:31.957Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-116166","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116166","modified":"Nov 3, 2026, 7:51:05 PM","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:50:31.939Z"},{"source":"GitHub Advisory Database","id":"GHSA-49c8-f3j8-87vv","url":"https://github.com/advisories/GHSA-49c8-f3j8-87vv","modified":"2026-11-03T21:32:22Z","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:50:31.939Z"},{"source":"NVD","id":"CVE-2026-95748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95748","modified":"2026-11-03T20:30:24.880","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:50:31.939Z"},{"source":"FIRST EPSS","id":"CVE-2026-95748","url":"https://www.first.org/epss/","probability":0.00189,"percentile":0.0853,"date":"2026-11-08","checkedAt":"2026-11-09T12:50:31.957Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have a SQL injection vulnerability, allowing an unauthenticated adjacent attacker to run arbitrary database commands. The weakness is due to improper neutralization of special elements in SQL commands. Successful exploitation could have an unspecified impact.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:46:02.097Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95748"}]}}