{"id":"CVE-2026-95760","aliases":[],"cve":{"records":[{"id":"CVE-2026-95760","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:06.321Z","published":"2026-11-03T19:51:14.329Z","modified":"2026-11-09T17:44:25.466Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:14.329Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T17:44:25.466Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-269","description":"CWE-269 Improper Privilege Management","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T17:44:02.462911Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Privilege Escalation Vulnerability in HPE Networking Fabric Composer API","titleSource":"hpe","descriptionSource":"hpe","description":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated privileges on the affected system.","score":6.4,"severity":"medium","published":"2026-11-03T19:51:14.329Z","modified":"2026-11-09T17:44:25.466Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95760"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95760","modified":"2026-11-09T17:44:25.466Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95760"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","score":6.4}],"sourceAffected":[],"observedAt":"2026-11-09T18:15:54.572Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T18:30:35.070Z","attemptedAt":"2026-11-09T18:30:35.070Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T18:30:35.213Z","attemptedAt":"2026-11-09T18:30:35.213Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T18:30:34.866Z","attemptedAt":"2026-11-09T18:30:34.866Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T18:30:34.054Z","attemptedAt":"2026-11-09T18:30:34.054Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95760","url":"https://www.first.org/epss/","probability":0.00213,"percentile":0.11662,"date":"2026-11-09","checkedAt":"2026-11-09T18:30:34.054Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116177","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116177","modified":"Nov 3, 2026, 7:51:14 PM","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","checkedAt":"2026-11-09T18:30:34.866Z"},{"source":"NVD","id":"CVE-2026-95760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95760","modified":"2026-11-09T18:17:36.000","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","checkedAt":"2026-11-09T18:30:35.070Z"},{"source":"GitHub Advisory Database","id":"GHSA-mv3f-hvc8-qp9h","url":"https://github.com/advisories/GHSA-mv3f-hvc8-qp9h","modified":"2026-11-03T21:32:22Z","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","checkedAt":"2026-11-09T18:30:35.213Z"}],"aiSummary":{"text":"A privilege escalation vulnerability exists in HPE Networking Fabric Composer API versions 7.0.0 to 7.4.0, allowing an authenticated attacker with low privileges to gain elevated privileges if certain preconditions are met. The attacker requires low privileges and certain conditions outside their control. Successful exploitation could lead to elevated privileges.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T18:16:16.518Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95760"}]}}