CVE-2026-95756: Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric Composer
A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
An attacker must be authenticated to the Fabric Composer API and have administrative privileges. Exploitation also depends on certain preconditions that are outside the attacker’s control.
Can this be exploited remotely?
Yes. The issue is described as exploitable by an authenticated remote attacker through the API, provided the attacker has administrative privileges and the required preconditions exist.
What is the potential impact of successful exploitation?
Successful exploitation could allow the attacker to gain elevated privileges on the underlying operating system. The provided severity vector indicates potential impact to confidentiality, integrity, and availability.