HPE Patches 46 Fabric Composer Flaws Including Critical Hardcoded Password Bug (CVE-2026-95731)
HPE has released patches for 46 vulnerabilities in HPE Networking Fabric Composer (AFC), a tool that automates and manages data center network fabrics. The most severe, CVE-2026-95731 (CVSS 9.8), is an unauthenticated hardcoded-credential flaw in the CLI that grants full administrative access. Two additional critical flaws, CVE-2026-95732 and CVE-2026-95733 (CVSS 9.6), allow an unauthenticated adjacent-network attacker to execute arbitrary code via authentication bypass and hardcoded credentials, respectively. HPE's internal research team discovered all 46 issues, and the vendor states it is not aware of any public exploit code or active exploitation.
Entenda a falha
A vulnerabilidade
HPE Networking Fabric Composer (AFC), which manages data center network fabrics, has 46 flaws fixed in advisory HPESBNW05172. The worst, CVE-2026-95731 (CVSS 9.8), is an unauthenticated hardcoded-credential flaw in the CLI that gives full administrative access to a remote attacker. CVE-2026-95732 (authentication bypass in the underlying operating system) and CVE-2026-95733 (hardcoded credentials in a component), both CVSS 9.6, let an unauthenticated attacker on the adjacent network execute arbitrary code. Others include authentication bypasses (CVE-2026-95738, CVE-2026-95746), missing brute-force protection (CVE-2026-95739), an unauthenticated API DoS (CVE-2026-95745), an adjacent SQL injection (CVE-2026-95748, CVSS 7.5) and an admin-only command injection (CVE-2026-95756, CVSS 6.6). Affected: 7.4.0 and below, and 7.3.4 and below; fixed in 7.4.1 and 7.3.5.
Como funciona
The articles give little step-by-step detail. For the top flaw, a remote party reaches the Fabric Composer CLI and presents the credentials built into the product; the CLI accepts them as valid and grants an administrative session. For the two adjacent-network critical flaws, an attacker on the same network segment reaches the underlying operating system or a component, where authentication is bypassed or fixed credentials are accepted, and this leads to arbitrary code execution. For the SQL injection, input from an adjacent unauthenticated attacker reaches a database query and lets them run database commands. Because Fabric Composer manages the switches, control of it can extend to the network fabric.
Por que é vulnerável
The critical flaws come from hardcoded credentials and a missing or bypassable authentication check, so the product trusts secrets that ship identically in every installation. Other flaws come from missing validation: certificates not checked properly (nine bugs), no limit on login attempts, and unsafe handling of input in the database and command paths. The articles do not explain why these went unnoticed. The fix is delivered in versions 7.4.1 and 7.3.5; the articles do not detail the code changes.
Como foi descoberta
HPE says its internal research team found all 46 vulnerabilities. They were disclosed through HPE's security bulletin HPESBNW05172. HPE states it is not aware of any public discussion or exploit code targeting them, and no exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:09.
Detalhes técnicos
The advisory (HPESBNW05172) covers 3 critical, 20 high, 18 medium and 5 low-severity bugs affecting Fabric Composer 7.4.0 and below and 7.3.4 and below. Sixteen of the 46 flaws require no authentication at all. Other notable issues include nine certificate-validation bugs that can leak data or bypass authentication, two authentication-bypass flaws (CVE-2026-95738, CVE-2026-95746), a missing brute-force protection (CVE-2026-95739), an unauthenticated DoS via API (CVE-2026-95745), seven privilege-escalation bugs, an unauthenticated adjacent SQL injection (CVE-2026-95748, CVSS 7.5), an admin-required command injection (CVE-2026-95756, CVSS 6.6), and two audit-log bypass/spoofing flaws.
Remediação
HPE urges customers to upgrade to Fabric Composer 7.4.1 or 7.3.5 or later. Versions past End of Support are considered potentially impacted but will not be evaluated or patched. Until upgraded, HPE recommends restricting CLI and web interface access to a dedicated Layer 2 segment/VLAN, enforcing firewall policies at Layer 3 and above, and enabling logging of user activity.
Linha do tempo
-
HPE Patches 46 Fabric Composer Flaws Including Critical Hardcoded Password Bug (CVE-2026-95731)
ler a análise desta fonte ocultar
HPE has released patches for 46 vulnerabilities in HPE Networking Fabric Composer (AFC), a tool that automates and manages data center network fabrics. The most severe, CVE-2026-95731 (CVSS 9.8), is an unauthenticated hardcoded-credential flaw in the CLI that grants full administrative access. Two additional critical flaws, CVE-2026-95732 and CVE-2026-95733 (CVSS 9.6), allow an unauthenticated adjacent-network attacker to execute arbitrary code via authentication bypass and hardcoded credentials, respectively. HPE's internal research team discovered all 46 issues, and the vendor states it is not aware of any public exploit code or active exploitation.
Technical Details
The advisory (HPESBNW05172) covers 3 critical, 20 high, 18 medium and 5 low-severity bugs affecting Fabric Composer 7.4.0 and below and 7.3.4 and below. Sixteen of the 46 flaws require no authentication at all. Other notable issues include nine certificate-validation bugs that can leak data or bypass authentication, two authentication-bypass flaws (CVE-2026-95738, CVE-2026-95746), a missing brute-force protection (CVE-2026-95739), an unauthenticated DoS via API (CVE-2026-95745), seven privilege-escalation bugs, an unauthenticated adjacent SQL injection (CVE-2026-95748, CVSS 7.5), an admin-required command injection (CVE-2026-95756, CVSS 6.6), and two audit-log bypass/spoofing flaws.
Remediation
HPE urges customers to upgrade to Fabric Composer 7.4.1 or 7.3.5 or later. Versions past End of Support are considered potentially impacted but will not be evaluated or patched. Until upgraded, HPE recommends restricting CLI and web interface access to a dedicated Layer 2 segment/VLAN, enforcing firewall policies at Layer 3 and above, and enabling logging of user activity.