---
id: CVE-2026-95756
title: >-
  Authenticated Command Injection Vulnerability in the API of HPE Networking
  Fabric Composer
summary: >-
  A command injection vulnerability exists in the API of HPE Networking Fabric
  Composer and could be exploited by an authenticated remote attacker with
  administrative privileges if certain preconditions outside of the attacker's
  control ar…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: Fabric Composer
affected:
  - fabric_composer >= 7.4.0 <= 7.4.0
  - fabric_composer >= 7.0.0 <= 7.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:51:11.348Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95756'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00688
epssPercentile: 0.52957
ingestedAt: '2026-11-05T20:33:06.414Z'
---

## Overview

A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.

## Affected

- `fabric_composer >= 7.4.0 <= 7.4.0`
- `fabric_composer >= 7.0.0 <= 7.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.