---
id: CVE-2026-95734
title: >-
  Authenticated Sensitive Information Disclosure in HPE Networking Fabric
  Composer API
summary: >-
  A sensitive information disclosure vulnerability in the API of HPE Networking
  Fabric Composer could allow an authenticated low-privileged user to access
  sensitive information beyond what is authorized by the user's existing
  privilege lev…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: Fabric Composer
affected:
  - fabric_composer >= 7.4.0 <= 7.4.0
  - fabric_composer >= 7.0.0 <= 7.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:50:52.110Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95734'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00358
epssPercentile: 0.2978
ingestedAt: '2026-11-05T20:33:06.407Z'
---

## Overview

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.

## Affected

- `fabric_composer >= 7.4.0 <= 7.4.0`
- `fabric_composer >= 7.0.0 <= 7.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.