CVE-2026-73703: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability exists in the web-based management interface of HPE Networking Fabric Composer version 7.0.0. It allows an unauthenticated attacker with adjacent network access to conduct a stored cross-site scripting (CWE-79) attack. Successful exploitation enables arbitrary script execution in the victim's browser context, potentially leading to full compromise of the interface session. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no privileges required but user interaction needed. No official patch or remediation level has been published by HPE as of the data provided.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser when interacting with the Fabric Composer management interface. This may result in theft of sensitive information, session hijacking, or other malicious actions within the context of the affected interface, severely impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fabric Composer management interface to trusted users and networks only. Employ web application firewalls or other security controls to detect and block XSS attack attempts if possible.