The vulnerability in HPE Cray Programming Environment allows a local unprivileged user to gain elevated access by exploiting the method used when CPE is deployed on HPCM. Because the flaw relies on local execution paths, an attacker with a basic user account could potentially obtain higher privileges, enabling them to modify system configurations or access sensitive data. This elevates the privilege level of the user on the affected system, impacting confidentiality, integrity, and availability at the host level.

The affected product is Hewlett Packard Enterprise’s Cray Programming Environment. Versions 25.03 and 25.09 are vulnerable, and the issue persists until the product is upgraded beyond version 26.03. No other HPE products are explicitly listed as impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation data yet. The weakness is classified under CWE‑276, pointing to improper privilege management. Exploitation requires local access; therefore, an attacker must already have a local account or gain local system access through other means. Without a public exploit, the likelihood of an immediate attack is low, but the local privilege escalation remains a high‑severity concern for any system running the vulnerable versions.