CVE-2026-73700: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability exists in HPE Fabric Composer's web management interface, where a low privilege authenticated operator can perform a stored XSS attack targeting administrative users. Successful exploitation enables arbitrary script execution in the administrator's browser session, potentially compromising confidentiality, integrity, and availability of the interface. The CVSS 3.1 base score is 9.0 (critical), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker with low privilege authenticated access can inject malicious scripts that execute in the context of an administrative user's browser session. This can lead to full compromise of the administrative interface, including theft of credentials, session hijacking, or unauthorized actions. The vulnerability affects confidentiality, integrity, and availability of the management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator user privileges and limit access to the management interface to trusted users only. Monitor for suspicious activity related to user sessions. Follow any additional guidance provided by HPE once available.