A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct… (CVE-2026-73703)

This vulnerability affects the web-based management interface of HPE Networking Fabric Composer. An unauthenticated attacker with adjacent network access can exploit a stored cross-site scripting (XSS) flaw to inject malicious scripts that execute in the browser of a user accessing the interface. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no privileges required but user interaction needed. No patch or remediation information is provided in the available data.

Exploitation could lead to arbitrary script execution in the victim's browser within the context of the management interface. This may result in theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the system managed via the interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted networks and users only, and consider using web application firewalls or other controls to detect and block XSS payloads.