Hewlett Packard Enterprise has patched a critical flaw in its Fabric Composer software that lets an attacker take administrator control without logging in. The bug, tracked as CVE-2026-95731, carries the maximum practical severity score of 9.8 out of 10 and sits in the product's command-line interface, where passwords were built into the software itself.

Fabric Composer is the tool that manages the network fabric inside data centres, so the stakes are high: anyone who reaches the command line with the built-in credentials can administer the fabric, steer traffic and move toward neighbouring network segments. HPE published the fix on 3 November 2026 in security bulletin HPESBNW05172, which covers 46 flaws in total, including three rated critical, 20 high and 18 medium. France's national cyber agency relayed the bulletin in its advisory CERTFR-2026-AVI-1451 on 4 November.

Versions 7.4.x before 7.4.1 and 7.3.x before 7.3.5 are affected, and the fix is to upgrade to 7.4.1 or 7.3.5. Two further critical flaws in the same bulletin, CVE-2026-95732 and CVE-2026-95733, both scored 9.6, allow code execution by an attacker on the adjacent network. A companion bulletin, HPESBNW05173, fixes nine flaws in the VIA remote-access client, with the corrected release numbered 4.7.9.

HPE says it is not aware of public discussion or exploit code for either bulletin, and no attacks have been confirmed. Even so, administrators should treat the update as urgent, because a hardcoded password has no workaround: until the patch is installed, the only defence is to keep the management interfaces off the internet and confined to a dedicated network segment. Any unexpected command-line session should be treated as a compromise, with credentials rotated and the incident investigated.