{"id":"CVE-2026-95762","aliases":["EUVD-2026-116179","GHSA-8pj8-f2pj-7v76"],"status":"published","title":"Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00233,"percentile":0.14281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2026-11-03T19:51:15Z","modified":"2026-11-09T16:23:36Z","products":[{"vendor":"hewlett packard enterprise (hpe)","product":"fabric composer"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us\u0026docLocale=en_US"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95762"},{"url":"https://github.com/advisories/GHSA-8pj8-f2pj-7v76"}],"sources":{"cve":[{"id":"CVE-2026-95762","title":"Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","status":"published","published":"2026-11-03T19:51:15.849Z","modified":"2026-11-09T16:23:36.473Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-09T17:34:05.709049Z"}],"euvd":[{"id":"EUVD-2026-116179","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","status":"published","published":"2026-11-03T19:51:15Z","modified":"2026-11-09T16:23:36Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-09T17:17:30.806151Z"}],"ghsa":[{"id":"GHSA-8pj8-f2pj-7v76","title":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric...","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","status":"published","published":"2026-11-03T21:32:16Z","modified":"2026-11-09T18:31:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-09T18:49:19.883486Z"}],"nvd":[{"id":"CVE-2026-95762","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","status":"published","published":"2026-11-03T20:18:24.88Z","modified":"2026-11-09T17:17:34.61Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-09T20:15:33.816361Z"}]}}