CVE-2026-76718: HPE OneView - Cross-site scripting vulnerability
Published Sep 29, 2026
·Updated
A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.
Affected Software
1 affected component
HPE OneView
Event History
Sep 29, 2026
CVE Published
via MITRE·09:58 AM
Data Sourced
via MITRE·09:58 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account or elevated privileges?
No privileges are required according to the supplied CVSS vector. The attack is network-based and has low attack complexity, but it does require user interaction.
2
What is the likely impact if the issue is exploited?
The reported impact includes remote session hijacking or other unauthorized actions. The CVSS vector indicates high confidentiality impact, low integrity impact, and no availability impact.
3
Which deployments are potentially exposed?
HPE OneView deployments reachable over a network are potentially in scope. The available information does not state whether any particular configuration, interface, or default deployment is affected.