---
id: CVE-2026-95735
title: Improper Certificate Validation in HPE Networking Fabric Composer
summary: >-
  An improper certificate validation vulnerability exists in HPE Networking
  Fabric Composer. Successful exploitation could allow an unauthenticated remote
  attacker, under certain preconditions outside the attacker's control, to
  obtain sens…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: Fabric Composer
affected:
  - fabric_composer >= 7.4.0 <= 7.4.0
  - fabric_composer >= 7.0.0 <= 7.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:50:52.845Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95735'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00223
epssPercentile: 0.12951
ingestedAt: '2026-11-05T20:33:06.406Z'
---

## Overview

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.

## Affected

- `fabric_composer >= 7.4.0 <= 7.4.0`
- `fabric_composer >= 7.0.0 <= 7.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.