{"id":"CVE-2026-95751","aliases":[],"cve":{"records":[{"id":"CVE-2026-95751","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:53:35.472Z","published":"2026-11-03T19:51:08.385Z","modified":"2026-11-09T12:50:40.585Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:08.385Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:50:40.585Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:47:13.386349Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","score":7.4,"severity":"high","published":"2026-11-03T19:51:08.385Z","modified":"2026-11-09T12:50:40.585Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95751"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95751","modified":"2026-11-09T12:50:40.585Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95751"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4}],"sourceAffected":[],"observedAt":"2026-11-09T13:00:53.887Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T13:05:32.840Z","attemptedAt":"2026-11-09T13:05:32.840Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T13:05:32.687Z","attemptedAt":"2026-11-09T13:05:32.687Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T13:05:32.897Z","attemptedAt":"2026-11-09T13:05:32.897Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T13:05:32.888Z","attemptedAt":"2026-11-09T13:05:32.888Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-f93j-5pqj-qcr6","url":"https://github.com/advisories/GHSA-f93j-5pqj-qcr6","modified":"2026-11-03T21:32:16Z","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:05:32.687Z"},{"source":"NVD","id":"CVE-2026-95751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95751","modified":"2026-11-03T20:30:24.880","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:05:32.840Z"},{"source":"FIRST EPSS","id":"CVE-2026-95751","url":"https://www.first.org/epss/","probability":0.0028,"percentile":0.20657,"date":"2026-11-08","checkedAt":"2026-11-09T13:05:32.888Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116169","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116169","modified":"Nov 3, 2026, 7:51:08 PM","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:05:32.897Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an improper certificate validation weakness, potentially allowing unauthenticated remote attackers to bypass authentication under certain conditions. Successful exploitation could lead to unauthorized access. The attacker must meet preconditions outside of their control.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:01:03.336Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95751"}]}}