CVE-2026-73700: Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrative users of the HPE Networking Fabric Composer web-based management interface are the intended victims. An authenticated low-privilege operator can store malicious script content that executes when an administrative user views it in the interface.
What does an attacker need to exploit it?
The attacker needs authenticated access as a low-privilege operator user and must induce an administrative user to interact with the stored malicious content. The attack is network-accessible and has low attack complexity.
What is the potential impact if exploitation succeeds?
The attacker can execute arbitrary script code in the victim administrator's browser within the context of the affected management interface. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the vulnerable component's security scope.