Skip to content
Threat Feed
Subscribe
critical advisory updated

HPE Networking Fabric Composer: Authenticated Sensitive Information Disclosure (CVE-2026-95734)

A public exploit is available for CVE-2026-95734, an authenticated sensitive information disclosure vulnerability in the HPE Networking Fabric Composer API.

CVE search metadata

CVE search record: CVE-2026-95734. Severity: high. CVSS: 8.8. KEV: no. Product: Networking Fabric Composer, HPE Networking Fabric Composer (< 7.3.5, < 7.4.1), HPE Networking Virtual Intranet Access (< 4.7.9). Brief: HPE Networking Fabric Composer: Authenticated Sensitive Information Disclosure (CVE-2026-95734). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-95734/

CVE search record: CVE-2026-95733. Severity: critical. CVSS: 9.6. KEV: no. Product: Networking Fabric Composer, HPE Networking Fabric Composer (< 7.3.5, < 7.4.1), HPE Networking Virtual Intranet Access (< 4.7.9). Brief: HPE Networking Fabric Composer: Authenticated Sensitive Information Disclosure (CVE-2026-95734). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-95734/

Triage facts

Revision 2
Applicability
Networking Fabric Composer, HPE Networking Fabric Composer (< 7.3.5, < 7.4.1) +1
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
8 public sources
Freshness
Revision 2Nov 4, 21:14 UTC
Vulnerabilities
2 CVEs
Source quality
C3Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for HPE Networking Fabric Composer (< 7.3.5, < 7.4.1) +1 products

    Changed: action_plan, affected_products, lastmod, references, tags, updates

    Sources: 1

CVE-2026-95734 is a sensitive information disclosure vulnerability in the HPE Networking Fabric Composer API. The vulnerability allows an authenticated low-privileged user to access sensitive information, including stored credentials, beyond their authorized privilege level. A proof-of-concept exploit has been published on Sploitus.

Immediate actions

Patch HPE Networking Fabric Composer to the latest version provided by HPE

IT Operations 24h

Patch HPE Networking Fabric Composer and Virtual Intranet Access to the versions indicated in the HPE security bulletins.

IT Operations 72h

Threat Hunt

Monitor for unauthorized administrative authentication or unusual process execution on the Fabric Composer management server

T1190 high medium confidence hunt now

Data: Server authentication logs, Process creation logs

Mitigations

Apply firmware/software updates provided in HPE security bulletin hpesbnw05172en_us

immediate IT Operations

CVE-2026-95733

Upgrade HPE Networking Fabric Composer to 7.3.5 or 7.4.1 and Virtual Intranet Access to 4.7.9.

immediate IT Operations

Affected HPE products