HPE OneView for VMware vCenter (vertical privilege escalation): A read-only user performs administrative actions

Impact

A read-only user performs administrative actions through the OneView vCenter plugin - so view-only access to vCenter becomes administrative control over HPE hardware management.

Who can reach it

Authenticated read-only user of the OV4VC plugin, with user interaction.

What to do

Apply the HPE update per HPESBGN04876. Plugin update inside vCenter; no server firmware work.

References

Related entries

• F5 BIG-IP (iHealth command / tmsh restricted shell): An authenticated attacker with at least a resource-administratorCVE-2025-61958 · F5 BIG-IP (iHealth command / tmsh restricted shell)High
• GitLab CE/EE: stored XSS in analytics dashboard pagination controlsCVE-2026-15216 · GitLab CE/EE (analytics dashboard pagination controls)High
• GitLab CE/EE: stored XSS in analytics dashboard table cell renderingCVE-2026-15217 · GitLab CE/EE (analytics dashboard table cell rendering)High
• Sigstore Fulcio: OIDC discovery follows cross-host redirects and leaks ServiceAccount tokensCVE-2026-49478 · Sigstore Fulcio (OIDC discovery HTTP client, cross-host redirects)High
• Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64): An out-of-boundsCVE-2026-55732 · Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64)High
• Netty: OpenSSL client path silently skips TLS hostname verification on Java 25+CVE-2026-62243 · Netty io.netty:netty-handler (SslProvider.OPENSSL client-side hostname verification)High