This vulnerability (CVE-2026-76719) in HPE OneView is caused by improper neutralization of input during web page generation, classified as CWE-79 (cross-site scripting). It enables remote attackers to perform actions such as session hijacking and data theft by injecting malicious scripts. The affected versions are all releases prior to 11.40. The CVSS v3.1 base score is 8.2, with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to session hijacking and unauthorized access to sensitive data, compromising confidentiality. The integrity impact is low, and availability is not affected. This can result in unauthorized actions performed by attackers within the context of the victim's session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Hewlett Packard Enterprise advisories for updates. In the meantime, limit exposure by restricting access to the HPE OneView interface to trusted users and networks and consider applying any available workarounds recommended by the vendor.