HPE fixes 46 Fabric Composer flaws, including a critical password bug

HPE has released details of 46 security vulnerabilities affecting its Fabric Composer (AFC) product, with the most severe entry, CVE-2026-95731, rated 9.8 on CVSS v3.1. The flaws span three critical, 20 high, 18 medium and five low severities and impact Fabric Composer versions 7.4.0 and earlier and 7.3.4 and earlier. The advisory HPESBNW05172 urges customers to upgrade to Fabric Composer 7.4.1 or 7.3.5 or newer.

The vulnerabilities include an unauthenticated hardcoded password that could grant administrative access, an authentication bypass enabling arbitrary code execution, and multiple issues involving hardcoded credentials in various components. The vendor states that, while no exploitation in the wild has been confirmed, the breadth and potential impact are significant enough to prompt urgent patching.

Fabric Composer automates data centre network fabrics, meaning an attacker who can access the managed switches may reach them directly. The report notes that 16 of the 46 bugs require no login, and several could be exploited from an adjacent network. The flaws cover areas ranging from certificate validation failures to authentication bypass and SQL or command injection in adjacent components.

Notably, CVE-2026-95731 involves an unauthenticated remote attacker using hardcoded credentials to gain administrative access; CVE-2026-95732 and CVE-2026-95733 concern authentication bypass and hardcoded credentials that could allow adjacent arbitrary code execution. HPE advises limiting CLI and web interfaces to a controlled network segment and logging user activity while customers upgrade. Affected versions are listed as 7.4.0 and below and 7.3.4 and below, with guidance to upgrade to 7.4.1 or 7.3.5 and above as soon as possible.