---
id: CVE-2026-95762
title: >-
  Authenticated Insufficient Session Expiration Vulnerability in the API of HPE
  Networking Fabric Composer
summary: >-
  An insufficient session expiration vulnerability exists in the API of HPE
  Networking Fabric Composer if certain preconditions outside of the attacker's
  control are met. Successful exploitation could allow an authenticated
  administrative …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: Fabric Composer
affected:
  - fabric_composer >= 7.4.0 <= 7.4.0
  - fabric_composer >= 7.0.0 <= 7.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:51:15.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95762'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00246
epssPercentile: 0.15886
ingestedAt: '2026-11-05T20:33:06.417Z'
---

## Overview

An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.

## Affected

- `fabric_composer >= 7.4.0 <= 7.4.0`
- `fabric_composer >= 7.0.0 <= 7.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.