HPE Fabric Composer and Cray CPE: Batch of 25 Vulnerabilities Disclosed
HPE disclosed 25 vulnerabilities across Fabric Composer and Cray Programming Environment, with many allowing information disclosure and privilege escalation.
Key findings
- 25 vulnerabilities disclosed across HPE Fabric Composer and Cray CPE.
- Multiple information disclosure and privilege escalation flaws in Fabric Composer.
- One High severity vulnerability in Cray Programming Environment allows elevated local access.
- Vulnerabilities range from Low to High severity, impacting various components and attack vectors.
- Users urged to consult HPE advisories for specific version information and mitigations.
HPE has released security advisories for a significant batch of 25 vulnerabilities affecting HPE Fabric Composer and HPE Cray Programming Environment (CPE). The vulnerabilities, disclosed between November 3rd and November 5th, 2026, range in severity from Low to High, with many concerning information disclosure and privilege escalation.
HPE Fabric Composer Vulnerabilities
The majority of the disclosed vulnerabilities impact HPE Fabric Composer. These include numerous information disclosure flaws (CVE-2026-95777, CVE-2026-95775, CVE-2026-95771, CVE-2026-95767, CVE-2026-95766, CVE-2026-95765, CVE-2026-95764, CVE-2026-95763, CVE-2026-95761, CVE-2026-95755, CVE-2026-95753), with several allowing unauthenticated remote attackers to obtain sensitive information. Some of these specifically target the management interface or involve improper certificate validation, potentially allowing interception of traffic or sensitive data.
Several privilege escalation vulnerabilities were also identified in the Fabric Composer API (CVE-2026-95760, CVE-2026-95753, CVE-2026-95719). Successful exploitation of these could allow authenticated low-privileged attackers to gain elevated privileges or disclose network traffic. Other notable issues include path traversal (CVE-2026-95776), denial-of-service (CVE-2026-95773), race conditions (CVE-2026-95772), audit log spoofing (CVE-2026-95769), insufficient session expiration (CVE-2026-95762), audit log bypass (CVE-2026-95759), authorization bypass (CVE-2026-95758), and command injection (CVE-2026-95756).
HPE Cray Programming Environment Vulnerability
Separately, a High severity vulnerability (CVE-2026-44875) was disclosed in HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03. This vulnerability could potentially allow a local unprivileged user to gain elevated access on the system.
Impact and Response
These vulnerabilities collectively present a significant risk to organizations utilizing HPE Fabric Composer and Cray CPE. The prevalence of information disclosure and privilege escalation flaws means that attackers could potentially gain deep access to sensitive data and control over managed systems. Users are strongly advised to consult HPE's security advisories for specific affected versions and recommended mitigation steps. While the advisories detail the vulnerabilities, specific patch versions are not universally detailed across all CVEs in the provided information, emphasizing the need for users to check individual advisories for their deployed versions.
Conclusion
This coordinated disclosure highlights the ongoing need for vigilance in managing the security of complex infrastructure software. Organizations using HPE Fabric Composer and Cray CPE should prioritize reviewing and applying any available patches or workarounds to address these newly identified vulnerabilities, particularly those with higher severity ratings or those that could lead to unauthorized access or data breaches.