{"id":"CVE-2026-95764","aliases":[],"cve":{"records":[{"id":"CVE-2026-95764","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:06.322Z","published":"2026-11-03T19:51:17.298Z","modified":"2026-11-09T16:20:51.602Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:17.298Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T16:20:51.602Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T16:20:47.908282Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.","score":5.7,"severity":"medium","published":"2026-11-03T19:51:17.298Z","modified":"2026-11-09T16:20:51.602Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95764"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95764","modified":"2026-11-09T16:20:51.602Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95764"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.7}],"sourceAffected":[],"observedAt":"2026-11-09T16:36:24.544Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:50:32.984Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T18:55:36.505Z","attemptedAt":"2026-11-09T18:55:36.505Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T19:00:33.986Z","attemptedAt":"2026-11-09T19:00:33.986Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T19:00:34.451Z","attemptedAt":"2026-11-09T19:00:34.451Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T19:00:32.531Z","attemptedAt":"2026-11-09T19:00:32.531Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95764","modified":"2026-11-09T17:17:34.897","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-09T18:55:36.505Z"},{"source":"FIRST EPSS","id":"CVE-2026-95764","url":"https://www.first.org/epss/","probability":0.00095,"percentile":0.00647,"date":"2026-11-09","checkedAt":"2026-11-09T19:00:32.531Z"},{"source":"GitHub Advisory Database","id":"GHSA-rgg9-94q4-r7p7","url":"https://github.com/advisories/GHSA-rgg9-94q4-r7p7","modified":"2026-11-09T18:31:48Z","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-09T19:00:33.986Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116181","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116181","modified":"Nov 9, 2026, 4:20:51 PM","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-09T19:00:34.451Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer versions 7.0.0 to 7.3.4 and 7.4.0 have an improper certificate validation weakness, potentially allowing an unauthenticated adjacent attacker to access sensitive information. The vulnerability exists in the API. Required attacker access is adjacent and unauthenticated.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T16:51:06.479Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95764"}]}}