This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] HPE fixes 13 vulnerabilities in its products

HPE fixes 13 vulnerabilities in its products [1][2][3]. The most severe of them are listed below. Products and their fixed versions: HPE Compute Scale-up Server 3200 - 1.76.44 and later [1] HPE Compute Scale-up Server 3250 - 1.02.48 and later [1] HPE Superdome Flex Server - 4.17.03 and later [1] HPE Superdome Flex 280 Server - 2.17.03 and later [1] HPE Unified OSS Console Core - 3.1.23 [2] HPE OneView - 11.40 and later [3]

HPE Compute Scale-up Server 3200 & 3250, Superdome Flex & Superdome Flex 280 servers - RCE, DoS (CVE-2026-45447)
CVSS 8.8 (High)

An authenticated remote attacker can, due to a use-after-free vulnerability in HPE Compute Scale-up Server 3200/3250 and Superdome Flex/Flex 280 servers, execute arbitrary code or perform a DoS attack [1].

The vulnerability is present in products:

  • HPE Compute Scale-up Server 3200; <1.76.44
  • HPE Compute Scale-up Server 3250; <1.02.48
  • HPE Superdome Flex Server; <4.17.03
  • HPE Superdome Flex 280 Server; <2.17.03

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 9. 2026.

HPE Unified OSS Console Core - MITM (CVE-2026-44494)
CVSS 8.7 (High)

An unauthenticated remote attacker can, due to a vulnerability in the Axios library in HPE Unified OSS Console Core, exploit prototype pollution to redirect HTTP traffic through their own proxy and perform a MITM attack [2][4].

The vulnerability is present in product:

  • HPE Unified OSS Console (UOC); <=3.1.22

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

  • CVE-2026-44494 at cve.org, NVD
  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') at cwe.mitre.org

The vulnerability was publicly disclosed 28. 9. 2026.

HPE OneView - XSS (CVE-2026-76719)
CVSS 8.2 (High)

An unauthenticated remote attacker can, due to an XSS vulnerability in HPE OneView, hijack a user session, steal data or perform unauthorized operations [3].

The vulnerability is present in products:

  • HPE OneView; <11.40
  • HPE Synergy Composer; <11.40

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

More information:

  • CVE-2026-76719 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 9. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 30. 9. 2026.

CESNET, z.s.p.o. Logo