CVE-2026-76719: HPE OneView - Cross-site scripting vulnerability
Published Sep 29, 2026
·Updated
A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.
Affected Software
1 affected component
HPE OneView
Event History
Sep 29, 2026
CVE Published
via MITRE·10:02 AM
Data Sourced
via MITRE·10:02 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or direct access to the HPE OneView appliance?
The supplied CVSS vector indicates no privileges are required and the attack can be performed over the network. It does require user interaction.
2
What could an attacker achieve if exploitation succeeds?
The advisory description states that exploitation may enable session hijacking, data theft, or other unauthorized actions. The CVSS vector rates confidentiality impact as high and integrity impact as low.
3
Is there any documented workaround or affected-version information?
The provided data does not identify affected versions, fixed versions, default-configuration conditions, or mitigations. Consult the referenced HPE advisory for product-specific remediation guidance.