Introduction
HPE Networking Fabric Composer sits at the control point of a data center fabric, so administrative access to it means authority over switch configuration, firewall policy, and fabric orchestration. On 3 November 2026, HPE disclosed that the product's command line interface contained hardcoded passwords that an unauthenticated remote attacker could use to log in with elevated privileges, and rated the issue CVSS 3.1 9.8.
Fabric Composer (AFC) is HPE's API-driven orchestration solution for network provisioning, security management, and operations across compute and storage infrastructure. HPE's validated deployment guidance uses it for initial provisioning and ongoing management of EVPN VXLAN data center fabrics, VMware vCenter integration, firewall policies on CX 10000 switches, and access control lists on CX switch models. It belongs to HPE's enterprise networking portfolio, which Gartner placed as a Leader in its 2026 Enterprise Wired and Wireless LAN Infrastructure Magic Quadrant. That ranking covers the broader market rather than Fabric Composer specifically, and it is not a security rating.
Technical information
Root cause
HPE and NVD describe CVE-2026-95731 as "hardcoded password vulnerabilities" in the AFC command line interface (CLI). The embedded credentials allow an unauthenticated remote attacker to access an affected system and obtain unauthorized administrative access with elevated privileges.
The record contains a few other details:
- The CVE entry lists two internal HPE tracking IDs, VULN-987 and VULN-994, and the description uses the plural. Together these suggest HPE found at least two separate hardcoded credential problems in the CLI and grouped them under one CVE. HPE states both IDs are fixed in 7.4.1 and 7.3.5.
- No CWE is populated in the official records. VulDB classifies the issue as CWE-798 (use of hardcoded credentials), which is a secondary classification rather than an HPE-assigned CWE.
- HPE has not published the account names, passwords, the authentication implementation, the service protocol or port, or the commands needed to reproduce the issue. We are not going to guess at those, and readers should treat any third-party claims about them with caution until HPE or researchers publish verifiable details.
- For this specific CVE, the documented consequence is administrative access, not an independently demonstrated arbitrary code execution exploit. The same bulletin contains separate code execution and command injection entries, and their descriptions should not be transferred to CVE-2026-95731.
Hardcoded credentials score this high because the secret is identical on every appliance running the affected build, so anyone who learns it can use it against every reachable installation. That also shapes what a correct fix looks like, as the patch section discusses.
CVSS vector
HPE, acting as CNA, supplied the score. NVD displays it but has not published a separate NIST assessment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- AV:N: network attack vector
- AC:L: low attack complexity
- PR:N: no privileges required
- UI:N: no user interaction
- S:U: scope unchanged
- C:H / I:H / A:H: high confidentiality, integrity, and availability impact
These values describe the assessed attack conditions. On their own, they do not document an observed attack.
Attack flow
Based on the advisory and the published vector, exploitation would proceed as follows:
- The attacker needs network reachability to the AFC command line interface (AV:N). No prior account or user interaction is required.
- The attacker logs in using the built-in password. Because these values ship in the product, they are the same across affected installations. HPE has not disclosed them, and HPE found the issue through internal research.
- A successful login yields administrative access with elevated privileges on AFC. In the logs this looks like an ordinary administrator session, with no malformed request, payload, or crash to observe.
- The attacker can then act with the platform's authority. Given AFC's documented functions (switch configuration, firewall policy definitions, fabric orchestration), administrative access to AFC is administrative access to the orchestration plane. The sources do not document any observed downstream compromise of managed switches through this CVE.
On unpatched systems, the same bulletin also discloses CVE-2026-95759 (a low-privileged authenticated user can suppress audit records of their own activity) and CVE-2026-95769 (an unauthenticated remote attacker can falsify the client address recorded in audit logs). An attacker holding administrative access via CVE-2026-95731 could plausibly combine these to reduce the forensic trail, which the detection guidance below takes into account.
Exploitation status
HPE states that, at release, it was not aware of public discussion or exploit code targeting the listed vulnerabilities. VulDB likewise reports no available exploit and unknown technical details, while assessing remote unauthenticated exploitation as apparently easy. No threat actor or campaign is publicly associated with this CVE. The CISA KEV feed snapshot we reviewed (catalog version 2026.10.30) predates publication, so it cannot establish KEV status either way. The defensible status is "exploitation unconfirmed," which is not the same as "not exploited."
Patch information
HPE fixed CVE-2026-95731 in HPESBNW05172 rev.1, a bundled advisory for AFC published on 3 November 2026. AFC is closed-source, appliance-style software, so there is no public commit, diff, or source change to examine. The fix exists only as new builds, and the advisory is the only authoritative description of it.
Fixed releases
- AFC 7.4.x: 7.4.0 and earlier are vulnerable. Fixed in 7.4.1 and later.
- AFC 7.3.x: 7.3.4 and earlier are vulnerable (NVD's affected range starts at 7.0.0). Fixed in 7.3.5 and later.
Fixed builds are available from the HPE Networking Support Portal. Versions at End of Maintenance are not covered and will not receive a backport. HPE does not evaluate or patch End of Support branches, so anything older than the supported 7.3.x and 7.4.x lines has to move onto one of them to get the fix.
HPE's September 2026 bulletin (HPESBNW05133) recommended 7.3.4 or 7.4.0 as the resolving releases for earlier Fabric Composer issues, and both of those versions are affected by this disclosure. If your remediation baseline was set in September, it needs to move to 7.3.5 or 7.4.1. This does not mean the September fixes failed to address their own vulnerabilities.
What the fix changes
HPE has not published how the fix works, for example whether the accounts were deleted, disabled, or replaced with per-device secrets generated at install time. As general background, not a confirmed account of HPE's changes: fixing a hardcoded credential (CWE-798 or CWE-259) means removing the static secret from the shipped image, or replacing it with a unique credential generated per install or set by the operator. Simply changing the password is not a fix, because the new value would again be identical on every appliance and would be exposed by the next firmware teardown. Given the two tracking IDs, the fix also has to remove every embedded secret, not just one account.
Related fixes in the same upgrade
The advisory covers 46 CVEs, all found by HPE Networking's internal security research, and HPE does not offer per-CVE hotfixes. Upgrading to 7.4.1 or 7.3.5 also resolves related credential and access control issues, including:
- CVE-2026-95733: hardcoded credentials in another AFC component (adjacent-network code execution, CVSS 9.6).
- CVE-2026-95732: an authentication bypass in the underlying operating system (CVSS 9.6).
- CVE-2026-95738 and CVE-2026-95747: authentication bypass and SSH privilege escalation issues.
HPE strongly urges customers to patch because of the vulnerabilities' "complexity, breadth, and impact."
Interim exposure reduction
HPE recommends the following controls to minimize the likelihood of exploitation, covering both CLI and web management interfaces:
- Place management interfaces on a dedicated Layer 2 segment or VLAN.
- Enforce firewall policies at Layer 3 and above to control access to management services.
- Enable accounting controls for tracking and logging user activities and resource usage.
HPE frames these as reducing likelihood. The software upgrade is the resolution, and these controls do not remove the hardcoded credentials.
Verifying the fix
After upgrading, check the running AFC version in the CLI or web UI: 7.4.1 or later on the 7.4 branch, or 7.3.5 or later on the 7.3 branch. HPE has not published a way to detect the hardcoded accounts, so the version number is the only vendor-backed confirmation. For implementation questions not covered by the bulletin, HPE directs customers to their normal HPE Services support channel.
Detection methods
As of the 3 November 2026 disclosure, no public signatures, IoCs, or log patterns exist for CVE-2026-95731. We found no YARA, Sigma, Snort, or Suricata rules. Because a successful attack is a valid login with built-in credentials, it looks like a normal administrator session. The guidance below is based on exposure and behaviour rather than a deployable signature.
1. Find vulnerable instances by version
Start with inventory. HPESBNW05172 and the NVD record list AFC 7.4.0 and earlier, and 7.3.4 and earlier (NVD: 7.0.0 through 7.3.4), as affected. HPE says any installation running affected software should be treated as vulnerable, and End of Maintenance and End of Support branches should be presumed exposed. Use your CMDB, vulnerability scanner, or asset inventory to flag every AFC instance in that range, and treat each as a host where any admin session could be an attacker.
2. Log user activity on the management interfaces
HPE's only detection-related advice is the accounting control recommendation above. In practice:
- Send CLI and web authentication events to your SIEM. With a hardcoded credential, the questions that matter are who logged in, from where, and when. Watch for admin sessions from source addresses outside approved management networks or jump hosts, sessions at unusual times, and sessions that do not match a change ticket.
- Track what happens after login. Accounting records of commands run and resources changed help surface an unexpected admin session that goes on to change fabric configuration, add accounts, or reach into managed switches.
- Watch network access to the management plane. If the CLI and web interfaces are restricted to a dedicated VLAN or firewalled segment, any connection from outside that zone is a strong lead. Firewall and NetFlow logs can catch this even if the appliance's own logs are incomplete.
3. Do not fully trust the AFC audit trail
On unpatched systems, CVE-2026-95759 allows suppression of a user's own audit records and CVE-2026-95769 allows falsification of the client address recorded in audit logs. Since CVE-2026-95731 grants administrative access, these could be combined. Cross-check AFC audit records against independent sources such as firewall logs, flow data, and jump host session records, and investigate gaps or mismatches.
Expect this picture to change if HPE or researchers later publish the credentials or exploit details, which would enable precise login-based detections.
Affected systems and versions
- HPE Networking Fabric Composer 7.0.0 through 7.3.4 (per the official CVE record, which HPE's bulletin phrases as 7.3.4 and below). Fixed in 7.3.5 and later.
- HPE Networking Fabric Composer 7.4.0 (HPE's bulletin phrases this as 7.4.0 and below). Fixed in 7.4.1 and later.
- End of Maintenance versions: presumed affected unless HPE states otherwise, with no backports.
- End of Support branches: not evaluated or patched by HPE. These must migrate to a supported 7.3.x or 7.4.x release.
- Configuration: the vulnerable component is the CLI, and any installation running an affected build is in scope. Instances whose CLI is reachable from networks beyond a restricted management segment carry the greatest exposure.
Vendor security history
This is not the first Fabric Composer bulletin of 2026. On 1 September 2026, HPE released HPESBNW05133 for vulnerabilities affecting Fabric Composer 7.3.3 and below, including CVE-2026-73711 (improper privilege assignment that could provide administrative access) and CVE-2026-73712 (unauthenticated remote code execution). HPE recommended 7.3.4 or 7.4.0 at the time, and both are now affected by CVE-2026-95731. An earlier advisory, HPESBNW04996, also covered multiple Aruba Fabric Composer vulnerabilities.
Both the September and November bulletins attribute discovery to internal HPE Networking research. HPE states that its secure development lifecycle follows NIST Secure Software Development Framework guidance and that its Product Security Response Team triages and coordinates disclosures and operates as HPE's CNA. Those are vendor process statements. The recurring disclosures document continuing defects in the product alongside an active internal discovery and remediation process. The sources do not support ranking HPE against peers.
References
- NVD: CVE-2026-95731
- CVE Record: CVE-2026-95731
- HPESBNW05172 rev.1: Multiple Vulnerabilities in HPE Networking Fabric Composer
- HPESBNW05172 CSAF advisory (text)
- HPE Networking Support Portal
- NVD API record for CVE-2026-95731
- HPESBNW05133 rev.1: Multiple Vulnerabilities in HPE Aruba Networking Fabric Composer
- HPESBNW04996 rev.1: Aruba Fabric Composer, Multiple Vulnerabilities
- Canadian Centre for Cyber Security: HPE security advisory AV26 873
- VulDB entry for CVE-2026-95731
- HPE Aruba Networking Fabric Composer product page
- Fabric Composer EVPN VXLAN Fabric Validated Solution Guide
- HPE Digital Trust Center: Security
- CISA Known Exploited Vulnerabilities feed (JSON)
- CISA Known Exploited Vulnerabilities Catalog
- HPE press release: 2026 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN Infrastructure
- CRN: 2025 Wired and WLAN Gartner Magic Quadrant coverage
