CVE-2026-73731

Analyzed Analyzed - Analysis Complete

Reflected XSS in HPE Networking Fabric Composer

Publication date: 2026-09-01

Last updated on: 2026-09-03

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-03

Generated

2026-09-22

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73731

EUVD

EUVD-2026-69458

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	fabric_composer	to 7.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) flaw in the web-based management interface of HPE Networking Fabric Composer. It allows an unauthenticated remote attacker to inject malicious scripts into the interface, which are then executed in a victim's browser when they access the affected page.

Detection Guidance

This vulnerability involves a reflected XSS attack in HPE Networking Fabric Composer's web interface. Detection requires checking for unusual script execution or input handling in the web interface. Monitor browser console logs for unexpected scripts and inspect network traffic for suspicious requests targeting the interface.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the user within the management interface. This could lead to unauthorized access or data theft if the victim has administrative privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate GDPR (data protection) or HIPAA (healthcare data privacy) requirements. Organizations must address it to maintain compliance with these regulations.

Mitigation Strategies

Immediately update HPE Networking Fabric Composer to the latest patched version. If an update is unavailable, restrict access to the web interface via network segmentation or firewall rules. Implement input validation and output encoding in the web interface to prevent XSS attacks.

Hi! I’m here to help you understand CVE-2026-73731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70