{"id":"CVE-2026-95755","aliases":[],"cve":{"records":[{"id":"CVE-2026-95755","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:06.321Z","published":"2026-11-03T19:51:10.509Z","modified":"2026-11-09T13:05:22.845Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:10.509Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:05:22.845Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:00:25.406630Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Adjacent Improper Certificate Validation allows Interception of Management Traffic in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","score":6.8,"severity":"medium","published":"2026-11-03T19:51:10.509Z","modified":"2026-11-09T13:05:22.845Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95755"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95755","modified":"2026-11-09T13:05:22.845Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95755"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-09T13:21:12.419Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T13:25:36.275Z","attemptedAt":"2026-11-09T13:25:36.275Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T13:25:36.761Z","attemptedAt":"2026-11-09T13:25:36.761Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T13:25:37.190Z","attemptedAt":"2026-11-09T13:25:37.190Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T13:25:36.296Z","attemptedAt":"2026-11-09T13:25:36.296Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95755","modified":"2026-11-09T13:17:11.727","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:25:36.275Z"},{"source":"FIRST EPSS","id":"CVE-2026-95755","url":"https://www.first.org/epss/","probability":0.00101,"percentile":0.00898,"date":"2026-11-08","checkedAt":"2026-11-09T13:25:36.296Z"},{"source":"GitHub Advisory Database","id":"GHSA-rx54-r32h-qqxw","url":"https://github.com/advisories/GHSA-rx54-r32h-qqxw","modified":"2026-11-03T21:32:22Z","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:25:36.761Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116172","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116172","modified":"Nov 3, 2026, 7:51:10 PM","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T13:25:37.190Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.4.0 have an improper certificate validation weakness, potentially allowing an unauthenticated adjacent attacker to intercept management traffic and obtain sensitive information under certain conditions. The attacker must be adjacent to the target. Successful exploitation could disclose sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:26:05.335Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95755"}]}}