T
Threats
HPE Fabric Composer Multiple Critical Vulnerabilities
Overview
Severity: Critical
Date: 5 November 2026
Hewlett Packard Enterprise (HPE) has released updates for HPE Networking Fabric Composer (AFC) to address multiple vulnerabilities. Three are rated Critical (CVSS 9.6 to 9.8). They could allow an unauthenticated attacker to gain administrative access or execute arbitrary code. Exploitation requires remote network access (CVE-2026-95731) or adjacent network access (CVE-2026-95732 and CVE-2026-95733).
Affected Versions
Affected: HPE Networking Fabric Composer (AFC) 7.4.0 and below, and 7.3.4 and below.
Fixed: HPE Networking Fabric Composer 7.4.1 and above (7.4.x branch), and 7.3.5 and above (7.3.x branch).
Not affected: HPE states that any other HPE Networking products not listed in the advisory are not affected. Software versions that have reached End of Maintenance or End of Support are not covered by the advisory and should be considered potentially impacted.
Source: HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer
Vulnerability Breakdown
CVE-2026-95731 - Hardcoded Password in the Command-Line Interface
Severity: Critical
CVSS: 9.8 (CVSS v3.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Description: Hardcoded password vulnerabilities in the Fabric Composer command-line interface could allow an unauthenticated remote attacker to access the system using hardcoded credentials.
Impact: Unauthorised administrative access with elevated privileges.
Conditions: No authentication or user interaction required. The attacker needs network access to the affected system.
Affected: 7.4.0 and below, 7.3.4 and below
Fixed: 7.4.1 and above, 7.3.5 and above
Not affected: No exceptions stated by the vendor for this CVE.
Source: HPESBNW05172 Security Bulletin
CVE-2026-95732 - Authentication Bypass Leading to Arbitrary Code Execution
Severity: Critical
CVSS: 9.6 (CVSS v3.1, vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Description: An authentication bypass vulnerability exists in the underlying operating system of Fabric Composer.
Impact: Arbitrary code execution on the affected system.
Conditions: Unauthenticated attacker with adjacent network access.
Affected: 7.4.0 and below, 7.3.4 and below
Fixed: 7.4.1 and above, 7.3.5 and above
Not affected: No exceptions stated by the vendor for this CVE.
Source: HPESBNW05172 Security Bulletin
CVE-2026-95733 - Use of Hardcoded Credentials Leading to Arbitrary Code Execution
Severity: Critical
CVSS: 9.6 (CVSS v3.1, vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Description: A vulnerability exists in a component of Fabric Composer. HPE titles the issue as the use of hardcoded credentials.
Impact: Arbitrary code execution on the affected system.
Conditions: Unauthenticated attacker with adjacent network access.
Affected: 7.4.0 and below, 7.3.4 and below
Fixed: 7.4.1 and above, 7.3.5 and above
Not affected: No exceptions stated by the vendor for this CVE.
Source: HPESBNW05172 Security Bulletin
The same bulletin also addresses additional High severity and lower rated vulnerabilities in Fabric Composer. Review the full bulletin for the complete CVE list.
Mitigation
Upgrade Fabric Composer to 7.4.1 or above (7.4.x branch) or 7.3.5 or above (7.3.x branch). Fixed versions are available from the HPE Networking Support Portal.
Where patching cannot be done immediately, HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, and/or controlling access with firewall policies at layer 3 and above.
Enable accounting controls to track and log user activity and resource usage.
Upgrade any deployment running an End of Maintenance or End of Support version to a supported release.
HPE is not aware of public discussion or exploit code targeting these vulnerabilities as of the release date. HPE still strongly urges customers to patch.
Summary for IT Teams
Products: HPE Networking Fabric Composer (AFC)
Threat Level: Critical, CVSS 9.8
Action Required: Upgrade to 7.4.1 or 7.3.5 (or later in each branch). Restrict management interfaces to a dedicated segment and apply firewall controls until patched.
Reference
HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer
HPE Networking Product Security Advisory HPESBNW05172 (signed text copy)
Need Help?
If your organisation needs assistance assessing or patching HPE Fabric Composer, the Secure ISS SOC team is ready to help. Please get in touch on 1300 769 460 or email us. We are here to help you strengthen your cybersecurity posture.
