Vulnerabilities · 10h ago

HPE Fabric Composer flaws expose admin access and code execution

INCIBE-CERT reports that HPE disclosed 46 vulnerabilities in HPE Networking Fabric Composer, including three critical flaws that can grant administrative access or execute code without authentication.

One flaw uses passwords built into the command-line interface (CLI), letting a remote attacker gain administrator access without logging in. The other two allow unauthenticated code execution from an adjacent network: one bypasses authentication in the underlying operating system, while the other uses built-in credentials in a component.

HPE lists fixes in 7.4.1 or later for the 7.4.x branch and 7.3.5 or later for 7.3.x; versions outside support may also be affected. Restricting web and CLI management interfaces can narrow exposure, but does not remove it. If Fabric Composer sits on a reachable management network, a compromise can put control of that system at risk, and unsupported installations remain potentially exposed.

CVE-2026-95731

NVD KEV

CVSS 9.8 CRITICAL: hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an…

CVE-2026-95732

NVD KEV

CVSS 9.6 CRITICAL: an authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer.

CVE-2026-95733

NVD KEV

CVSS 9.6 CRITICAL: a vulnerability exists in a component of HPE Networking Fabric Composer.

Timeline

Nov 4 Reported by INCIBE-CERT

Sources

1 source covering this story

INCIBE-CERT Nov 4
Múltiples vulnerabilidades en Fabric Composer de HPE
HPE ha publicado 46 vulnerabilidades en HPE Networking Fabric Composer: 3 de severidad crítica, 20 alt

Entities

CVE-2026-95731
CVE-2026-95732
CVE-2026-95733

Part of the PlainSec briefing for 2026-11-04

Editions

Briefing for 2026-11-04

Vulnerabilities · 10h agoHPE Fabric Composer flaws expose admin access and code executionINCIBE-CERT reports that HPE disclosed 46 vulnerabilities in HPE Networking Fabric Composer, including three critical flaws that can grant administrative access or execute code without authentication.One flaw uses passwords built into the command-line interface (CLI), letting a remote attacker gain administrator access without logging in. The other two allow unauthenticated code execution from an adjacent network: one bypasses authentication in the underlying operating system, while the other uses built-in credentials in a component.HPE lists fixes in 7.4.1 or later for the 7.4.x branch and 7.3.5 or later for 7.3.x; versions outside support may also be affected. Restricting web and CLI management interfaces can narrow exposure, but does not remove it. If Fabric Composer sits on a reachable management network, a compromise can put control of that system at risk, and unsupported installations remain potentially exposed.