{"id":"CVE-2026-95756","aliases":[],"cve":{"records":[{"id":"CVE-2026-95756","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:06.321Z","published":"2026-11-03T19:51:11.348Z","modified":"2026-11-09T13:09:20.941Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:11.348Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:09:20.941Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:09:13.974734Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.","score":6.6,"severity":"medium","published":"2026-11-03T19:51:11.348Z","modified":"2026-11-09T13:09:20.941Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95756"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95756","modified":"2026-11-09T13:09:20.941Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95756"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.6}],"sourceAffected":[],"observedAt":"2026-11-09T13:21:14.255Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:40:35.012Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T13:25:32.860Z","attemptedAt":"2026-11-09T13:25:32.860Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T13:25:32.860Z","attemptedAt":"2026-11-09T13:25:32.860Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T13:25:32.860Z","attemptedAt":"2026-11-09T13:25:32.860Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T13:25:31.920Z","attemptedAt":"2026-11-09T13:25:31.920Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95756","url":"https://www.first.org/epss/","probability":0.00688,"percentile":0.52976,"date":"2026-11-08","checkedAt":"2026-11-09T13:25:31.920Z"},{"source":"GitHub Advisory Database","id":"GHSA-rqw6-4mg2-vj2f","url":"https://github.com/advisories/GHSA-rqw6-4mg2-vj2f","modified":"2026-11-03T21:32:16Z","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T13:25:32.860Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116173","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116173","modified":"Nov 3, 2026, 7:51:11 PM","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T13:25:32.860Z"},{"source":"NVD","id":"CVE-2026-95756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95756","modified":"2026-11-09T13:17:11.950","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T13:25:32.860Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer API has a command injection vulnerability, affecting versions 7.0.0 to 7.4.0. An authenticated attacker with administrative privileges may exploit it under certain conditions, potentially gaining elevated operating system privileges.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:26:14.484Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95756"}]}}