A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect… (CVE-2026-73734)

This vulnerability in HPE Networking Fabric Composer's web interface permits an unauthenticated remote attacker to perform arbitrary URL redirection. The flaw is classified as CWE-601 (Open Redirect). The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity. No known exploits are reported in the wild, and no official patch or fix has been disclosed.

An attacker can redirect users of the management interface to arbitrary URLs, potentially facilitating phishing or social engineering attacks. However, the vulnerability does not directly compromise system confidentiality, integrity, or availability. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of suspicious links and verify URLs when accessing the management interface.