HPE Fabric Composer CVE-2026-73700

Exploitation requires an authenticated low-privilege operator account on the Fabric Composer web interface (PR:L) AND an administrative user subsequently viewing the attacker-injected stored content (UI:R) - the attack does not fire until an admin renders the malicious data. Limiting factors: the attacker must already possess operator credentials, so this is a privilege-escalation/insider path rather than fully unauthenticated remote compromise, and success depends on an admin interacting with the affected interface element.

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) yields 9.0, but the raw number should be read carefully: exploitation requires an existing authenticated operator account (PR:L) and an administrator actually viewing the malicious content (UI:R), which meaningfully constrains real-world attack paths compared to a pure unauthenticated RCE. The high score is inflated by the scope-change and full-impact ratings that model an operator escalating to admin-context script execution; the actual technical impact is browser-side script execution, not native code execution on the appliance. No EPSS score, KEV entry, or POC is provided, so exploitation probability signals are absent rather than reassuring - this reads as a plausible insider/privilege-escalation risk rather than a mass-exploited internet threat. Because Fabric Composer sits in the network control plane, any team operating one - even a mid-sized municipal IT operator in sopot - should patch promptly since a compromised admin session could pivot to fabric-wide configuration changes, though the operator-account prerequisite makes this lower urgency than the CVSS 9.0 alone suggests.

A malicious or compromised low-privilege operator injects a JavaScript payload into a stored field (e.g., a name, description, or comment) in the Fabric Composer UI. When an administrator later opens the view containing that data, the script executes in the admin's authenticated session, letting the attacker perform admin actions such as altering fabric configuration or creating accounts. No public POC is currently identified.