CVE-2026-95734 PUBLISHED

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

Assigner: hpe
Reserved: 22.09.2026 Published: 03.11.2026 Updated: 03.11.2026

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product Fabric Composer
Versions Default: affected
  • affected from 7.4.0 to 7.4.0 (incl.)
  • affected from 7.0.0 to 7.3.4 (incl.)

Credits

  • Internal security research (HPE Networking). reporter

References