---
id: CVE-2026-95767
title: Unauthenticated Information Disclosure in HPE Networking Fabric Composer
summary: >-
  An unauthenticated information disclosure vulnerability exists in the API of
  HPE Networking Fabric Composer. Successful exploitation could allow an
  unauthenticated remote attacker to obtain sensitive information about the
  affected system.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: Fabric Composer
affected:
  - fabric_composer >= 7.4.0 <= 7.4.0
  - fabric_composer >= 7.0.0 <= 7.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:51:19.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95767'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00251
epssPercentile: 0.16595
ingestedAt: '2026-11-05T20:33:06.418Z'
---

## Overview

An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.

## Affected

- `fabric_composer >= 7.4.0 <= 7.4.0`
- `fabric_composer >= 7.0.0 <= 7.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.