CVE-2026-76718: HPE OneView - Cross-site scripting vulnerability

High severity · published Sep 29, 2026

CVE-2026-76718

HPE OneView - Cross-site scripting vulnerability

8.2

CVSS

0.2%

EPSS

On KEV

Description

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

HPE OneView · Hewlett Packard Enterprise

before 11.40 · source: vendor

Affected product

HPE OneView

Hewlett Packard Enterprise

All HPE OneView CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-76718

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-76718

vendor-advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn05140en_us&docLocale=en_US