{"id":"CVE-2026-95772","aliases":[],"cve":{"records":[{"id":"CVE-2026-95772","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:32.623Z","published":"2026-11-03T19:51:24.161Z","modified":"2026-11-09T13:49:29.531Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:51:24.161Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:49:29.531Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:48:36.432478Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Authenticated Race Condition in API of HPE Networking Fabric Composer","titleSource":"hpe","descriptionSource":"hpe","description":"A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.","score":4.2,"severity":"medium","published":"2026-11-03T19:51:24.161Z","modified":"2026-11-09T13:49:29.531Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95772"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95772","modified":"2026-11-09T13:49:29.531Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95772"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","score":4.2}],"sourceAffected":[],"observedAt":"2026-11-09T13:56:01.184Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:00:32.242Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T14:00:36.306Z","attemptedAt":"2026-11-09T14:00:36.306Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T14:00:36.323Z","attemptedAt":"2026-11-09T14:00:36.323Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T14:00:36.747Z","attemptedAt":"2026-11-09T14:00:36.747Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T14:00:36.217Z","attemptedAt":"2026-11-09T14:00:36.217Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95772","url":"https://www.first.org/epss/","probability":0.00156,"percentile":0.04819,"date":"2026-11-08","checkedAt":"2026-11-09T14:00:36.217Z"},{"source":"NVD","id":"CVE-2026-95772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95772","modified":"2026-11-03T20:30:24.880","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-11-09T14:00:36.306Z"},{"source":"GitHub Advisory Database","id":"GHSA-v256-34r4-j75q","url":"https://github.com/advisories/GHSA-v256-34r4-j75q","modified":"2026-11-03T21:32:22Z","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-11-09T14:00:36.323Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116189","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116189","modified":"Nov 3, 2026, 7:51:24 PM","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-11-09T14:00:36.747Z"}],"aiSummary":{"text":"A race condition vulnerability in HPE Networking Fabric Composer's API affects versions 7.0.0 to 7.4.0, allowing an authenticated attacker with low privileges to potentially corrupt the configuration state. The vulnerability requires authenticated access. The impact is configuration state corruption.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T14:01:12.717Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95772"}]}}