CVE-2026-95731CVSS 9.8CLI hardcoded credentials enable administrator access
CLI hardcoded credentials enable administrator access. Requires remote network access and no prior authentication; no user interaction is required.
HPE Fabric Composer patches 46 flaws, including unauthenticated administrator access
HPE fixes 46 Fabric Composer flaws, including remote administrator access through CLI credentials and adjacent-network code execution. Upgrade 7.4.x to 7.4.1+ or 7.3.x to 7.3.5+ and restrict management interfaces. Reviewed sources do not confirm exploitation.
- Disclosed
- Nov 3, 2026
- Public disclosure date
- Severity
- CVSS 9.8 × 1
- 46 CVEs tracked here
- Splash zone
- Fabric Composer management deployments through 7.4.0 / 7.3.4; individual flaws require remote, adjacent or local access
- networking
- In the wild
- Unknown
- No confirmed exploitation in reviewed sources; HPE reports no public exploit code.
What happened
HPE’s November 3 bulletin groups 46 vulnerabilities in the same Fabric Composer release batch. It covers CVE-2026-95731 through CVE-2026-95777 except CVE-2026-95754, which is not listed. The highest score is 9.8. The risk to a datacenter management plane, including unauthenticated administrative access and adjacent-network code execution, supports L3; a critical score alone does not establish widespread exploitation.
The remote CLI credential issue is distinct from the two critical adjacent-network issues. Other flaws require accounts, local access, user interaction or additional circumstances outside the attacker’s control. The individual entries preserve the access, privilege and interaction requirements from HPE’s CVSS data; unspecified additional preconditions must not be assumed to be default configuration. Exposure depends on reachability of the relevant interface, not simply possession of any HPE device. Other HPE Networking products not listed in the bulletin are unaffected.
HPE identifies the affected versions as 7.4.0 and below and 7.3.4 and below. The fixed supported branches are 7.4.1+ and 7.3.5+. Obsolete versions need migration: end-of-maintenance versions are presumed affected, while end-of-support exposure has not been assessed. Network isolation is temporary risk reduction, not a replacement for upgrading.
All findings came from HPE’s internal research. HPE says it knew of no public discussion or exploit code at publication; that statement is not confirmation that exploitation never occurred. The reviewed material provides no confirmed exploitation, breach scope, victim count, recovery event or published attack indicators.
What’s in the bowl
CVE-2026-95732CVSS 9.6OS authentication bypass permits code execution
OS authentication bypass permits code execution. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95733CVSS 9.6Component flaw permits code execution
Component flaw permits code execution. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95734CVSS 8.8API exposes stored credentials beyond the caller’s authority
API exposes stored credentials beyond the caller’s authority. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95735CVSS 8.7Certificate validation flaw exposes credentials under additional preconditions
Certificate validation flaw exposes credentials under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95736CVSS 8.3Certificate validation flaws expose sensitive traffic under additional preconditions
Certificate validation flaws expose sensitive traffic under additional preconditions. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95737CVSS 8.2OS flaw raises an already privileged local account’s privileges
OS flaw raises an already privileged local account’s privileges. Requires local access and a high-privilege account; no user interaction is required.
CVE-2026-95738CVSS 8.1Authentication bypass grants administrator access under additional preconditions
Authentication bypass grants administrator access under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95739CVSS 8.1Insufficient API login limits permit brute force and administrator access under additional preconditions
Insufficient API login limits permit brute force and administrator access under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95740CVSS 8Certificate validation flaw exposes server communications under additional preconditions
Certificate validation flaw exposes server communications under additional preconditions. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95741CVSS 8Missing API integrity checks permit privilege escalation
Missing API integrity checks permit privilege escalation. Requires remote network access and a low-privilege account; user interaction is required.
CVE-2026-95742CVSS 7.8OS file-write flaw creates or replaces files with elevated privileges
OS file-write flaw creates or replaces files with elevated privileges. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95743CVSS 7.8OS flaws elevate a local low-privilege account
OS flaws elevate a local low-privilege account. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95744CVSS 7.7Interface flaw exposes protected traffic under additional preconditions
Interface flaw exposes protected traffic under additional preconditions. Requires adjacent-network access and a low-privilege account; no user interaction is required.
CVE-2026-95745CVSS 7.5API denial of service disables management services
API denial of service disables management services. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95746CVSS 7.5API authentication bypass grants unauthorized access under additional preconditions
API authentication bypass grants unauthorized access under additional preconditions. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95747CVSS 7.5SSH flaw exposes internal services under additional preconditions
SSH flaw exposes internal services under additional preconditions. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95748CVSS 7.5SQL injection permits arbitrary database commands
SQL injection permits arbitrary database commands. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95749CVSS 7.5Missing integrity checks permit code execution
Missing integrity checks permit code execution. Requires remote network access and no prior authentication; user interaction is required.
CVE-2026-95750CVSS 7.5Certificate validation flaw exposes credentials under additional preconditions
Certificate validation flaw exposes credentials under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95751CVSS 7.4API certificate validation flaw permits authentication bypass under additional preconditions
API certificate validation flaw permits authentication bypass under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95752CVSS 7.1Local API flaw permits privilege escalation
Local API flaw permits privilege escalation. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95753CVSS 7.1API flaw exposes traffic from managed switches
API flaw exposes traffic from managed switches. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95755CVSS 6.8Certificate validation flaws expose management traffic under additional preconditions
Certificate validation flaws expose management traffic under additional preconditions. Requires adjacent-network access and no prior authentication; no user interaction is required.
CVE-2026-95756CVSS 6.6API command injection raises an administrator’s OS privileges under additional preconditions
API command injection raises an administrator’s OS privileges under additional preconditions. Requires remote network access and a high-privilege account; no user interaction is required.
CVE-2026-95757CVSS 6.5Local API authentication bypass writes files to configured remote servers
Local API authentication bypass writes files to configured remote servers. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95758CVSS 6.5API authorization bypass permits protected-resource modification
API authorization bypass permits protected-resource modification. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95759CVSS 6.5API flaws suppress audit records of attacker activity
API flaws suppress audit records of attacker activity. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95760CVSS 6.4API flaw permits privilege escalation under additional preconditions
API flaw permits privilege escalation under additional preconditions. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95761CVSS 5.9Certificate validation flaw exposes sensitive information
Certificate validation flaw exposes sensitive information. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95762CVSS 5.9API session expiration flaw preserves administrator access under additional preconditions
API session expiration flaw preserves administrator access under additional preconditions. Requires remote network access and a high-privilege account; no user interaction is required.
CVE-2026-95763CVSS 5.9Certificate validation flaw exposes transferred files and remote-server credentials under additional preconditions
Certificate validation flaw exposes transferred files and remote-server credentials under additional preconditions. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95764CVSS 5.7API certificate validation flaw exposes sensitive information
API certificate validation flaw exposes sensitive information. Requires adjacent-network access and no prior authentication; user interaction is required.
CVE-2026-95765CVSS 5.4Web management interface exposes sensitive information
Web management interface exposes sensitive information. Requires remote network access and no prior authentication; user interaction is required.
CVE-2026-95766CVSS 5.3Information disclosure exposes data to a low-privilege account
Information disclosure exposes data to a low-privilege account. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95767CVSS 5.3API exposes sensitive system information
API exposes sensitive system information. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95768CVSS 5.3API flaw exposes sensitive information under additional preconditions
API flaw exposes sensitive information under additional preconditions. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95769CVSS 5.3API permits audit-record client-address spoofing
API permits audit-record client-address spoofing. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95770CVSS 4.7OS flaw exposes local sensitive data under additional preconditions
OS flaw exposes local sensitive data under additional preconditions. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95771CVSS 4.3API endpoint exposes limited system information
API endpoint exposes limited system information. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95772CVSS 4.2API race corrupts configuration state
API race corrupts configuration state. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95773CVSS 3.8Local denial of service disrupts other workloads on the host
Local denial of service disrupts other workloads on the host. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95774CVSS 3.7Remote information disclosure exposes sensitive data
Remote information disclosure exposes sensitive data. Requires remote network access and no prior authentication; no user interaction is required.
CVE-2026-95775CVSS 3.3OS file disclosure permits limited local reads
OS file disclosure permits limited local reads. Requires local access and a low-privilege account; no user interaction is required.
CVE-2026-95776CVSS 3.1API path traversal reads limited OS files under additional preconditions
API path traversal reads limited OS files under additional preconditions. Requires remote network access and a low-privilege account; no user interaction is required.
CVE-2026-95777CVSS 3.1Management interface exposes stored sensitive data
Management interface exposes stored sensitive data. Requires remote network access and a low-privilege account; no user interaction is required.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| HPE Networking Fabric Composer 7.4.x | 7.4.1 | Supported |
| HPE Networking Fabric Composer 7.3.x | 7.3.5 | Supported |
| End-of-maintenance / end-of-support branches | No fix | Move to a supported release |
Crime-scene timeline
Nov 3, 16:00 UTC
HPE publishes HPESBNW05172 revision 1
The official CSAF records this publication time and lists all 46 vulnerabilities, fixed branches and management-isolation advice.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- HPE HPESBNW05172 revision 1PrimaryFull November 3 bulletin: 46 CVEs, supported fixes, obsolete-release caveats, individual prerequisites and management isolation. No public exploit code known to HPE at publication.
- HPE official CSAF bulletinPrimaryMachine-readable version of the same bulletin, not an independent report; confirms publication at 16:00 UTC, scores and access requirements.