{"id":"CVE-2026-95769","aliases":[],"cve":{"records":[{"id":"CVE-2026-95769","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:32.623Z","published":"2026-11-03T19:51:21.673Z","modified":"2026-11-09T13:45:07.446Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:21.673Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:45:07.446Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-117","description":"CWE-117 Improper Output Neutralization for Logs","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:44:24.525111Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.","score":5.3,"severity":"medium","published":"2026-11-03T19:51:21.673Z","modified":"2026-11-09T13:45:07.446Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95769"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95769","modified":"2026-11-09T13:45:07.446Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95769"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-09T13:56:31.660Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T14:10:35.780Z","attemptedAt":"2026-11-09T14:10:35.780Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T14:10:35.780Z","attemptedAt":"2026-11-09T14:10:35.780Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T14:10:35.780Z","attemptedAt":"2026-11-09T14:10:35.780Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T14:10:33.941Z","attemptedAt":"2026-11-09T14:10:33.941Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95769","url":"https://www.first.org/epss/","probability":0.00236,"percentile":0.14684,"date":"2026-11-08","checkedAt":"2026-11-09T14:10:33.941Z"},{"source":"GitHub Advisory Database","id":"GHSA-66jr-v2mg-jg22","url":"https://github.com/advisories/GHSA-66jr-v2mg-jg22","modified":"2026-11-03T21:32:17Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T14:10:35.780Z"},{"source":"NVD","id":"CVE-2026-95769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95769","modified":"2026-11-03T20:30:24.880","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T14:10:35.780Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116186","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116186","modified":"Nov 3, 2026, 7:51:21 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T14:10:35.780Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer API versions 7.0.0 to 7.4.0 are affected by an audit log spoofing vulnerability, allowing an unauthenticated remote attacker to falsify the client address in audit records. The weakness is due to improper output neutralization for logs.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T14:01:21.427Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95769"}]}}