HPE Fabric Composer CVE-2026-73703

The attacker must have network adjacency to the HPE Fabric Composer management interface - typically meaning presence on the management VLAN, data center management subnet, or a network segment with direct routing to the management interface IP. The unauthenticated injection point (PR:N) means the attacker does not need valid credentials to deliver the stored payload. Exploitation is completed only when an authenticated user (UI:R) visits the page containing the stored payload; without this user interaction, the payload sits dormant. Limiting factors: AV:A confines the attacker population to hosts on or directly routable to the management segment, excluding internet-based attackers; UI:R requires a privileged user to trigger execution, preventing fully automated or worm-style propagation.

CVSS 8.8 (AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) captures the key risk drivers accurately: the management interface appears accessible only on adjacent network segments (AV:A), reducing the exposed attack surface compared to internet-facing services. However, PR:N confirms the injection point requires no authentication, making payload delivery achievable by any host on the management VLAN or subnet. The UI:R requirement means exploitation is not fully automated - a privileged user must visit the poisoned page - but in practice, administrators routinely access management interfaces and a single visit completes the attack. No EPSS data, KEV status, or public POC is available in the provided intelligence, so real-world exploitation probability cannot be quantified beyond the CVSS signal. The S:C/C:H/I:H/A:H impact triad is plausible for a network fabric management platform: admin session compromise could enable destructive fabric reconfiguration. The adjacent-only vector significantly limits exposure compared to a typical internet-facing stored XSS, but the management network is often accessible to multiple internal teams, making this a meaningful lateral-movement pivot point for an insider or post-compromise attacker.

An attacker with access to the management network segment - such as an insider, a compromised workstation on the corporate LAN, or an attacker who has pivoted from a less-sensitive network - submits a crafted input containing malicious JavaScript to an unauthenticated form or field in the Fabric Composer management interface. The payload is stored server-side. When a Fabric Composer administrator next logs in and navigates to the affected page, the script executes in their browser, silently exfiltrating the session token to an attacker-controlled server and granting full administrative access to the fabric management platform. No public POC is identified at time of analysis.