{"id":"CVE-2026-95762","aliases":[],"cve":{"records":[{"id":"CVE-2026-95762","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:06.322Z","published":"2026-11-03T19:51:15.849Z","modified":"2026-11-09T16:23:36.473Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:15.849Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T16:23:36.473Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-613","description":"CWE-613 Insufficient Session Expiration","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T16:22:47.595263Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","score":5.9,"severity":"medium","published":"2026-11-03T19:51:15.849Z","modified":"2026-11-09T16:23:36.473Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95762"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95762","modified":"2026-11-09T16:23:36.473Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95762"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-09T16:36:21.659Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:35:33.315Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T17:50:33.442Z","attemptedAt":"2026-11-09T17:50:33.442Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T17:50:35.908Z","attemptedAt":"2026-11-09T17:50:35.908Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T17:50:36.097Z","attemptedAt":"2026-11-09T17:50:36.097Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T17:50:34.695Z","attemptedAt":"2026-11-09T17:50:34.695Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95762","modified":"2026-11-09T17:17:34.610","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T17:50:33.442Z"},{"source":"FIRST EPSS","id":"CVE-2026-95762","url":"https://www.first.org/epss/","probability":0.00246,"percentile":0.15882,"date":"2026-11-09","checkedAt":"2026-11-09T17:50:34.695Z"},{"source":"GitHub Advisory Database","id":"GHSA-8pj8-f2pj-7v76","url":"https://github.com/advisories/GHSA-8pj8-f2pj-7v76","modified":"2026-11-03T21:32:22Z","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T17:50:35.908Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116179","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116179","modified":"Nov 9, 2026, 4:23:36 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-09T17:50:36.097Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer API versions 7.0.0 to 7.4.0 have an insufficient session expiration vulnerability, allowing authenticated administrative attackers to maintain access under certain conditions. The vulnerability requires specific preconditions and administrative access. Successful exploitation could lead to persistent system access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T16:46:15.294Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95762"}]}}