A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to… (CVE-2026-73700)

This vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. An authenticated user with low privilege operator rights can perform a stored cross-site scripting attack targeting administrative users of the interface. Successful exploitation enables execution of arbitrary script code in the administrator's browser context, potentially compromising administrative control and sensitive data. The CVSS v3.1 base score is 9.0, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with low privilege operator access can inject malicious scripts that execute in an administrator's browser session. This can lead to unauthorized actions, data theft, or further compromise of the management interface. The vulnerability affects confidentiality, integrity, and availability of the system managed through the interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator user privileges and limit access to the management interface to trusted users only. Monitor for suspicious activity involving operator accounts and administrative sessions.