A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a… (CVE-2026-73731)

This vulnerability involves a reflected XSS flaw in the web management interface of HPE Networking Fabric Composer. An unauthenticated attacker can craft a malicious link or input that, when visited or processed by a user of the interface, executes arbitrary JavaScript in the victim's browser. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality and integrity but not availability. No known exploits in the wild or patch information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary script code in the victim's browser within the context of the affected interface, potentially leading to limited disclosure or manipulation of information accessible through the interface. There is no indication of impact on system availability. The attack requires user interaction and does not require authentication or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted links or inputs in the management interface. Monitor official HPE communications for updates on patches or mitigations.