CVE-2026-76719 PUBLISHED

HPE OneView - Cross-site scripting vulnerability

Assigner: hpe
Reserved: 19.08.2026 Published: 29.09.2026 Updated: 29.09.2026

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS Score: 8.2

Product Status

Vendor Hewlett Packard Enterprise
Product HPE OneView
Versions Default: affected
  • affected from 0 to 11.40 (excl.)

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE

Impacts

  • CAPEC-593 Session Hijacking