{"id":"CVE-2026-95734","published":"2026-11-03T20:18:21.550","lastModified":"2026-11-03T20:30:24.880","description":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An authenticated low-privileged user can access sensitive credentials stored on the system due to insufficient authorization checks in the HPE Networking Fabric Composer API.","exploitability":"Exploitation requires valid low-privilege credentials and no additional user interaction or complex conditions.","blast_radius":"An attacker could obtain stored credentials, enabling lateral movement, privilege escalation, or full system compromise depending on credential scope.","remediation":"Apply HPE's patch for CVE-2026-95734; if unavailable, restrict API access to the affected endpoint to users with elevated privileges and audit existing low-privilege access.","detection":"Monitor for low-privilege users accessing sensitive API endpoints (e.g., credential retrieval or configuration export) outside normal operational patterns; look for anomalous API calls to /api/v1/credentials or similar paths in authentication and API logs.","tags":["sensitive-data-exposure","authorization-bypass","api-security","credential-theft"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:58:15.887Z"}}