HPE fixes 46 Fabric Composer flaws, including built-in CLI passwords

HPE fixes 46 Fabric Composer flaws, including built-in CLI passwords

4 November 2026: HPE has published fixes for 46 vulnerabilities in Networking Fabric Composer, three of them critical, led by CVE-2026-95731: built-in passwords on the command line interface that give an attacker with no login administrative access. INCIBE-CERT, which reported the bulletin, lists none of the three as exploited, and versions 7.4.1 and 7.3.5 fix the set.

Not yet independently verified. HPE's bulletin HPESBNW05172 would not load for us, so the details come from INCIBE-CERT's notice on it. We have no CVSS scores and have not read the 43 flaws below critical. We will update this when it can be confirmed, and remove this note.

Credentials shipped in the product

Two of the three critical flaws come down to secrets that ship with the software, which no amount of careful password policy on the customer's side would have changed.

• CVE-2026-95731: built-in CLI passwords let an unauthenticated remote attacker gain administrative access
• CVE-2026-95732: an authentication bypass in the underlying operating system lets an unauthenticated attacker on an adjacent network run code
• CVE-2026-95733: built-in credentials in a component allow arbitrary code execution from an adjacent network

The remainder are 20 high, 18 medium and 5 low. Fabric Composer is the tool that automates configuration across a data centre's switching fabric, so whoever controls it has a route to change the network itself rather than one server on it.

Which versions need the upgrade

The bulletin covers version 7.4.0 and versions 7.0.0 to 7.3.4. The way out depends on the line in use:

• 7.4.x branch: 7.4.1 or later
• 7.3.x branch: 7.3.5 or later
• versions out of support: potentially affected, so migrate to a supported branch

Downloads are on the HPE Networking support portal. A site on 7.0, 7.1 or 7.2 has no fix in its own line named in the notice and should plan the larger jump.

Containing it until the change window

Network automation tools rarely get an emergency slot, because a mistake during the upgrade can touch the fabric. The notice gives an interim step: limit the web and command line management interfaces to a dedicated VLAN or through firewall rules, and log administrative activity.

Since two of the critical flaws need an attacker on an adjacent network, the size of that management segment matters as much as its firewall. A flat management network shared with other systems gives more footholds than one that holds only the fabric's own tools. Reviewing administrative logs for unfamiliar sessions on the CLI is the obvious check, since a built-in password leaves no failed login to notice.

We reported HPE's Aruba AOS wireless fixes, a separate bulletin for a different product line. Our network monitoring software category lists eight products.

Related on TrustList:

• HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless
• Juniper fixes nine critical Junos flaws, several giving root code execution
• Juniper fixes two critical root flaws in Session Smart Router

Sources

• INCIBE-CERT: Multiple vulnerabilities in HPE Fabric Composer, INCIBE-2026-830, 4 November 2026, 4 November 2026
• HPE security bulletin HPESBNW05172 rev.1 (page did not load, read 7 November 2026), 7 November 2026