CVE-2026-73703: Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
The attack requires an unauthenticated attacker on an adjacent network and a user of the affected web-based management interface. The attacker’s payload executes in the victim user’s browser in the context of that interface.
Does exploitation require credentials or user interaction?
The attacker does not need privileges or authentication. However, exploitation requires user interaction by a victim using the management interface.
What impact can a successful attack have?
A successful stored XSS attack allows arbitrary script code to execute in the victim’s browser in the context of the affected interface. The provided severity vector rates confidentiality, integrity, and availability impact as high.