HPE Fabric Composer EUVD-2026-69458

The target must be an authenticated user of the HPE Fabric Composer web management interface who actively clicks or follows a crafted URL delivered by the attacker (UI:R is mandatory - the attack cannot succeed without this step). The attacker requires no credentials of their own (PR:N) and operates entirely over the network (AV:N) with no special configuration or race condition required (AC:L). Exploitation is fundamentally constrained by the need for victim interaction: if administrators access Fabric Composer only from isolated workstations with strict URL filtering or do not receive external communications, delivery becomes the primary obstacle. The management interface's typical network exposure (internal-only vs. internet-facing) is the dominant environmental factor determining realistic risk.

The CVSS 6.1 Medium score reflects a measured but real threat: AV:N and AC:L indicate easy network delivery with no special conditions, while PR:N confirms no attacker credentials are required. The critical moderating factor is UI:R - exploitation strictly requires a victim to actively click or follow a crafted link, eliminating any autonomous scanning or mass-exploitation potential. The Scope:Changed flag is significant in practice: session tokens accessible in the management interface context could allow an attacker to pivot to full administrative control of the fabric, elevating the effective impact beyond the base C:L/I:L metrics suggest. No EPSS score was provided, and the absence of a KEV listing and public exploit indicates this vulnerability is not currently being exploited at scale. For organizations where the Fabric Composer management interface is internet-facing or reachable via phishing-susceptible email environments, real-world risk should be rated higher than the numeric score alone implies. Internal-only deployments with strong perimeter controls carry substantially lower residual risk.

An attacker identifies the reflected XSS parameter in a Fabric Composer management URL and crafts a link embedding a JavaScript payload that exfiltrates the victim's session cookie to an attacker-controlled server. The attacker delivers this link via phishing email or a compromised internal collaboration tool to a network administrator known to manage the fabric. When the administrator clicks the link while authenticated to Fabric Composer, the payload executes in their browser session, granting the attacker a cloned authenticated session with full management privileges.