HPE OneView CVE-2026-76718

Requires an authenticated HPE OneView administrator (the victim) to load attacker-controlled content in the OneView web interface - the CVSS UI:R metric makes victim interaction mandatory, so this cannot be exploited fully unattended against a default configuration. The attacker themselves needs no credentials (PR:N) and reaches the target over the network (AV:N), but exploitation is limited by the need to deliver the payload to and trigger it within a logged-in operator's browser session. The specific vulnerable feature, page, or parameter is not identified in the HPE advisory text provided, so defenders should consult hpesbgn05140en_us for the exact affected component and fixed version.

This is a moderately high-severity XSS (CWE-79) in HPE OneView with a vendor-assigned CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). The elevated score is driven by the network vector, no privileges required, a scope change (S:C, reflecting the browser execution context breaking out of the vulnerable application boundary), and high confidentiality impact - consistent with the described 'session hijacking' where an attacker who steals an authenticated admin's session token gains that admin's access. However, the score is tempered by the mandatory user interaction (UI:R): a victim must be induced to load attacker-controlled content, so this is not a wormable or fully automatable flaw. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so no evidence of active exploitation exists - this is a real-priority issue given the privileged nature of OneView administrators but not an emergency. The description is notably vague ('remote session hijacking or other unauthorized actions'), and only a single HPE self-published advisory is provided as a source, so the exact injection point, whether it is stored or reflected, and affected/fixed version boundaries cannot be confirmed from the available data - verify specifics against HPE advisory hpesbgn05140en_us.

An attacker crafts a malicious link or payload that, when loaded by an authenticated HPE OneView administrator, executes attacker-controlled JavaScript in the OneView web UI context and exfiltrates the admin's session token or performs actions as that admin (session hijacking). Because privileges are not required (PR:N) but user interaction is (UI:R), the attacker must socially engineer or otherwise get a logged-in operator to trigger the payload. No public exploit code has been identified at time of analysis.