HPE Fixes 46 Fabric Composer Vulnerabilities, Including Critical Hardcoded Password Flaw CVE-2026-95731
Do Son 
TL;DR
HPE has patched 46 security flaws in HPE Networking Fabric Composer, also known as AFC. The worst of these HPE Fabric Composer vulnerabilities, CVE-2026-95731, scores 9.8 on CVSS v3.1. It lets an unauthenticated attacker log in with hardcoded credentials and gain admin access.
HPE’s advisory HPESBNW05172 covers three critical, 20 high, 18 medium and five low-severity bugs. They affect Fabric Composer 7.4.0 and below and 7.3.4 and below. Upgrade to 7.4.1 or 7.3.5 now.
- Product: Hewlett Packard Enterprise (HPE) Fabric Composer
- Vulnerabilities: 3 flaws (CVE-2026-95731, CVE-2026-95732, CVE-2026-95733)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: Unauthenticated Hardcoded Password in HPE Networking Command-Line Interface allow Unauthorized Administrative Access
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-95731 | 9.8 | Unauthenticated Hardcoded Password in HPE Networking Command-Line Interface allow Unauthorized Administrative Access | Not exploited |
| CVE-2026-95732 | 9.6 | Authentication Bypass in HPE Networking allows Arbitrary Code Execution | Not exploited |
| CVE-2026-95733 | 9.6 | Use of Hardcoded Credentials in HPE Networking Could Allow Adjacent Arbitrary Code Execution | Not exploited |
Why It Matters
Fabric Composer automates and manages data center network fabrics. So an attacker who controls it could reach the switches it manages. In fact, 16 of the 46 bugs need no login at all, and several work from an adjacent network. HPE’s internal research team found all 46 flaws.
The vendor says it “is not aware of any public discussion or exploit code that targets the listed vulnerabilities.” No exploitation in the wild has been confirmed. Even so, HPE says “Customers are strongly urged to patch their instances.” It cites “the complexity, breadth, and impact of these vulnerabilities.”
By the numbers
- Total CVEs: 46, from CVE-2026-95731 to CVE-2026-95777
- Critical (9.0 and above): 3
- High (7.0 to 8.9): 20
- Medium: 18
- Low: 5
How the Attacks Work
Hardcoded CLI password (CVE-2026-95731, CVSS 9.8)
According to HPE, the flaw “could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials.” As a result, an attacker could “gain unauthorized administrative access to the affected system with elevated privileges.”
Adjacent code execution (CVE-2026-95732 and CVE-2026-95733, CVSS 9.6)
CVE-2026-95732 is an authentication bypass in the product’s underlying operating system. Meanwhile, CVE-2026-95733 involves hardcoded credentials in a component. Both “could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.” In other words, the attacker needs access to the same local network segment.
Other notable bugs
- Certificate validation: nine bugs fail to check certificates properly. Depending on the flaw, this can leak data, bypass authentication or let attackers intercept management traffic.
- Authentication bypass: CVE-2026-95738 and CVE-2026-95746 could let unauthenticated attackers “circumvent existing authentication controls” when certain conditions are met.
- Brute force and DoS: CVE-2026-95739 fails to limit login attempts, and CVE-2026-95745 lets an unauthenticated remote attacker cause a denial of service through the API.
- Privilege escalation: seven local, API and SSH flaws let users gain higher rights.
- SQL injection (CVE-2026-95748, CVSS 7.5): an unauthenticated adjacent attacker could “run arbitrary database commands.”
- Command injection (CVE-2026-95756, CVSS 6.6): this API bug requires an admin account.
- Audit log issues: two flaws let attackers bypass or spoof audit log entries.
Affected Versions
- HPE Networking Fabric Composer 7.4.0 and below
- HPE Networking Fabric Composer 7.3.4 and below
Every listed flaw applies to both branches unless the advisory notes otherwise. HPE adds that versions past End of Support “should be considered potentially impacted.” It does not evaluate or patch those releases.
Patch and Mitigation
To fix these HPE Fabric Composer vulnerabilities, upgrade to one of the following versions:
- Fabric Composer 7.4.x: 7.4.1 and above
- Fabric Composer 7.3.x: 7.3.5 and above
Until you can upgrade, HPE recommends limiting the CLI and web interfaces “to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.” It also advises logging of user activity. Downloads are on the HPE Networking Support Portal.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
