HPE OneView CVE-2026-76720

Exploitation requires an attacker to deliver a specially crafted HPE OneView URL to a victim and for that victim to click it (UI:R) - the flaw cannot be triggered without human interaction, which is the primary limiting factor. No authentication is required to craft the malicious link (PR:N), and it works against the OneView management web interface reachable over the network. Impact is limited to redirecting the victim's browser to an arbitrary attacker-chosen destination; there is no direct compromise of the OneView server itself. Realistic risk depends on an administrator being socially engineered into clicking a link that appears to originate from a trusted OneView host.

This is a genuinely low-priority issue and the signals are internally consistent. The CVSS 3.1 base score of 4.3 (Medium) aligns with an open-redirect flaw: the vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, low-complexity, unauthenticated weakness that nonetheless REQUIRES user interaction (a victim must click a crafted link) and yields only limited confidentiality impact (C:L, e.g. leaking a session token or referrer to an attacker-controlled destination, or lending credibility to a phishing page) with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. Open redirects are rarely exploited in isolation and are typically chained into phishing or OAuth/token-theft flows rather than used for direct compromise, which keeps real-world risk low despite network reachability. No conflicting signals: the CVSS vector, the CWE-601 classification, and the description (remotely triggered URL redirect requiring victim interaction) all agree. This is a real-but-minor issue, not a high-CVSS/low-real-risk mismatch.

An attacker crafts a URL pointing at the legitimate HPE OneView management interface but containing a redirect parameter that sends the victim onward to an attacker-controlled site. An administrator who trusts the OneView hostname clicks the link and is silently forwarded to a phishing page (or a page that harvests forwarded tokens/referrer data). No public proof-of-concept exploit code was identified in the provided data.