This vulnerability (CVE-2026-76720) in HPE OneView involves an open redirect issue (CWE-601) that can be remotely exploited to redirect users to untrusted URLs. The CVSS 3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact is limited to low confidentiality impact with no integrity or availability impact. The affected versions are all HPE OneView releases from version 0 up to but excluding 11.40.

An attacker can exploit this vulnerability to redirect users to potentially malicious external websites, which may facilitate phishing or social engineering attacks. The confidentiality impact is low, and there is no impact on integrity or availability. No active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Hewlett Packard Enterprise advisories for updates. Until a fix is available, caution should be exercised when clicking on URLs generated by HPE OneView, and user awareness training on phishing risks is recommended.