HPE OneView EUVD-2026-88698

Requires the HPE OneView web management interface to be reachable by the attacker's crafted input and, critically, requires a legitimate authenticated user (typically an administrator) to view or interact with the attacker-controlled content (UI:R) for the injected script to execute. No attacker authentication is needed to plant the payload (PR:N), but the scope-changed impact (S:C, C:H) depends on the victim's session privilege. Exploitation is limited by this mandatory victim interaction, making it opportunistic/targeted rather than fully automatable; no non-default configuration is indicated as required by the sparse description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, base 8.2) describes a reflected/stored XSS (CWE-79) reachable over the network with low complexity and no attacker authentication, but requiring victim interaction (UI:R) and crossing a security scope boundary (S:C) - meaning attacker-controlled script executes in the browser context of a legitimate, likely privileged, HPE OneView user. The high confidentiality impact (C:H) reflects that hijacking an authenticated administrator session in an infrastructure-management console can expose credentials, tokens, and managed-server data; integrity is only low (I:L) and availability is unaffected (A:N). Real-world urgency is tempered because no exploitation signals accompany the report: there is no CISA KEV listing, no EPSS score supplied, and no public POC - so this is not confirmed active exploitation, just a vendor-disclosed weakness. The mandatory UI:R condition means an attacker must lure or wait for a victim to interact with malicious content, making this targeted rather than mass-automatable. Net: a genuinely serious flaw given the privileged admin context, but priority is moderate rather than emergency because exploitation depends on user interaction and no in-the-wild activity is evidenced.

An attacker crafts input containing malicious JavaScript that HPE OneView renders unsanitized in a page viewed by an authenticated administrator; when the admin views that content, the script runs in their session and steals the session token or performs actions as that admin. No public exploit code has been identified, and the attack requires the victim admin to load the malicious content (UI:R).