CVE-2026-73731: Vulnerability in Hewlett Packard Enterprise (HPE) Fabric Composer

This vulnerability involves a reflected XSS issue in HPE Fabric Composer's web management interface, allowing an unauthenticated attacker to inject and execute arbitrary scripts in a victim's browser session. The flaw affects version 7.0.0 of the product. The CVSS vector indicates the attack requires no privileges and low attack complexity but requires user interaction. The impact includes limited confidentiality and integrity loss but no availability impact. The vendor has published the vulnerability but has not yet provided an official fix or mitigation details.

Successful exploitation could allow an attacker to execute arbitrary script code in the context of the affected interface, potentially leading to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed by the victim user. There is no indication of availability impact or privilege escalation. The attack requires user interaction and targets users of the web management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when accessing the Fabric Composer web interface and avoid interacting with untrusted links or inputs. Monitor vendor communications for updates on patches or mitigations.