Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-95734: HPE Fabric Composer API may expose credentials to low‑privilege users
CVE-2026-95734 · published 1 day ago
Summary
The API used by HPE Fabric Composer can let a user with limited rights see data they shouldn't, such as stored passwords. This could let an attacker gather sensitive credentials from the system. Apply the latest patches from HPE and limit API access to trusted accounts.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | fabric composer | <= 7.4.0 |
Original advisory text
Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API
A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Track software like this
Free during beta