HPE Fabric Composer: hardcoded credentials rated 9.8
CVE-2026-95731: a hardcoded password in the command line of HPE Fabric Composer grants unauthenticated admin access. Fixed in 7.3.5 and 7.4.1.
Who is affected
- HPE Networking Fabric Composer 7.4.x before 7.4.1
- HPE Networking Fabric Composer 7.3.x before 7.3.5
- Not in this wave: ClearPass, ArubaOS Wi-Fi controllers
How to fix
Upgrade Fabric Composer to 7.4.1 (7.4.x branch) or 7.3.5 (7.3.x branch) per bulletin HPESBNW05172; also update the VIA remote-access client (fixed in 4.7.9, bulletin HPESBNW05173); keep the admin console behind an operations VLAN, never exposed to the internet; if an unexpected command-line session appears, treat the fabric as compromised and rotate its credentials.
What happened
On November 3, 2026 HPE published bulletin HPESBNW05172 (revision 1), a 56-vulnerability wave in HPE Networking Fabric Composer, the data-center network fabric orchestrator. The worst, CVE-2026-95731 (9.8, critical): hardcoded passwords in the command-line interface let an unauthenticated remote attacker obtain administrator access. The bulletin also covers remote code execution and privilege escalation. France's national CERT relayed the HPE bulletins in advisory CERTFR-2026-AVI-1451 on November 4.
Why it matters for a hotel
Fabric Composer does not live in the hallway: it drives the fabric connecting the data center, back office and sometimes the building-technology network of a large property or campus. Admin access without a valid password means an attacker can steer traffic, isolate systems or move toward the VLANs next door. If your group or integrator runs Aruba/HPE gear in a data center, the question is precise: which Fabric Composer version, patched when.
Who is affected
HPE Networking Fabric Composer 7.4.x before 7.4.1 and 7.3.x before 7.3.5. The same day, bulletin HPESBNW05173 fixed nine flaws in the VIA remote-access client (all platforms before 4.7.9), the tool network administrators and integrators use to reach sites. This wave does not affect ClearPass or ArubaOS Wi-Fi controllers.
How to fix
- Upgrade Fabric Composer to 7.4.1 or 7.3.5 depending on the installed branch, following bulletin HPESBNW05172; schedule the window off peak, but a hardcoded password has no workaround.
- Update the VIA client to 4.7.9 or later on every operations workstation, including contractor machines.
- Verify the Fabric Composer console is unreachable from the internet and sits behind an operations VLAN.
- Hunt authentication logs for command-line sessions from unusual addresses.
- If a suspect session appears: treat the fabric as compromised, rotate credentials and open an investigation with your integrator.
Context
The wave was pre-announced by HPE; another lands November 10 on the private 5G core. It illustrates the orchestration-gear risk: few devices, hugely privileged, usually missing from the property's patch list because a third party owns them. CERT-FR's November 4 advisory stresses remote code execution and privilege escalation.