VYPR
advisoryPublished Nov 5, 2026· Updated Nov 7, 2026· 1 source

HPE Fabric Composer and Cray CPE: Batch of 25 Vulnerabilities Disclosed

Key findings • 25 vulnerabilities disclosed across HPE Fabric Composer and Cray CPE. • Multiple information disclosure and privilege escalation flaws in Fabric Composer. • One High severi…

Key findings

  • 25 vulnerabilities disclosed across HPE Fabric Composer and Cray CPE.
  • Multiple information disclosure and privilege escalation flaws in Fabric Composer.
  • One High severity vulnerability in Cray Programming Environment allows elevated local access.
  • Vulnerabilities range from Low to High severity, impacting various components and attack vectors.
  • Users urged to consult HPE advisories for specific version information and mitigations.

HPE has released security advisories for a significant batch of 25 vulnerabilities affecting HPE Fabric Composer and HPE Cray Programming Environment (CPE). The vulnerabilities, disclosed between November 3rd and November 5th, 2026, range in severity from Low to High, with many concerning information disclosure and privilege escalation.

HPE Fabric Composer Vulnerabilities

The majority of the disclosed vulnerabilities impact HPE Fabric Composer. These include numerous information disclosure flaws (CVE-2026-95777, CVE-2026-95775, CVE-2026-95771, CVE-2026-95767, CVE-2026-95766, CVE-2026-95765, CVE-2026-95764, CVE-2026-95763, CVE-2026-95761, CVE-2026-95755, CVE-2026-95753), with several allowing unauthenticated remote attackers to obtain sensitive information. Some of these specifically target the management interface or involve improper certificate validation, potentially allowing interception of traffic or sensitive data.

Several privilege escalation vulnerabilities were also identified in the Fabric Composer API (CVE-2026-95760, CVE-2026-95753, CVE-2026-95719). Successful exploitation of these could allow authenticated low-privileged attackers to gain elevated privileges or disclose network traffic. Other notable issues include path traversal (CVE-2026-95776), denial-of-service (CVE-2026-95773), race conditions (CVE-2026-95772), audit log spoofing (CVE-2026-95769), insufficient session expiration (CVE-2026-95762), audit log bypass (CVE-2026-95759), authorization bypass (CVE-2026-95758), and command injection (CVE-2026-95756).

**HPE Cray Programming Environment Vulnerability**

Separately, a High severity vulnerability (CVE-2026-44875) was disclosed in HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03. This vulnerability could potentially allow a local unprivileged user to gain elevated access on the system.

Impact and Response

These vulnerabilities collectively present a significant risk to organizations utilizing HPE Fabric Composer and Cray CPE. The prevalence of information disclosure and privilege escalation flaws means that attackers could potentially gain deep access to sensitive data and control over managed systems. Users are strongly advised to consult HPE's security advisories for specific affected versions and recommended mitigation steps. While the advisories detail the vulnerabilities, specific patch versions are not universally detailed across all CVEs in the provided information, emphasizing the need for users to check individual advisories for their deployed versions.

Conclusion

This coordinated disclosure highlights the ongoing need for vigilance in managing the security of complex infrastructure software. Organizations using HPE Fabric Composer and Cray CPE should prioritize reviewing and applying any available patches or workarounds to address these newly identified vulnerabilities, particularly those with higher severity ratings or those that could lead to unauthorized access or data breaches.

Synthesized by Vypr AI