‹ Back to list

CVE-2026-76740

Status: Awaiting AnalysisHigh (7.2)—
Severity7.2High · CVSS 3.1
Exploitation probability0.37 %higher than 30% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

CVSS

Base score
7.2
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.37 %
Percentile among all scored CVEs
30
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector AV:N con PR:H (privilegios altos requeridos) lleva a T1210; la descripción indica ejecución arbitraria de comandos en el RMC, consistente con CWE-78.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Affected technologies (4)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

HPE — Compute Scale-up Server 3200AIHPE — Compute Scale-up Server 3250AIHPE — Superdome FlexAIHPE — Superdome Flex 280AI

CWEs

References

Show 1 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-76740",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-76740",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-19T17:30:49.825388Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@hpe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise",
          "product": "HPE Compute Scale-up Server 3200 platform",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.77.30",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Hewlett Packard Enterprise",
          "product": "HPE Compute Scale-up Server 3250 platform",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.03.38",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Hewlett Packard Enterprise",
          "product": "HPE Superdome Flex server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.17.03",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Hewlett Packard Enterprise",
          "product": "HPE Superdome Flex 280 server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.17.03",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-19T07:16:31.900",
  "references": [
    {
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf05153en_us&docLocale=en_US",
      "source": "security-alert@hpe.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-alert@hpe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC."
    }
  ],
  "lastModified": "2026-10-19T21:13:39.973",
  "sourceIdentifier": "security-alert@hpe.com"
}