A flaw in HPE NonStop Java JToolkit permits attackers to embed arbitrary operating system commands within input that the JToolkit processes. The vulnerability is a classic command‑injection weakness (CWE‑78) that can also lead to a buffer overflow, enabling the attacker to run code with the same privileges as the JToolkit process. This could compromise the confidentiality, integrity, or availability of the affected system by executing malicious commands or crashing the service.

The affected product is Hewlett Packard Enterprise's HPE NonStop Java JToolkit. No specific version information is listed, so all installations of this product are potentially vulnerable until a vendor‑issued fix is applied.

With a CVSS score of 3.8 indicating low‑severity impact and an EPSS score of less than 1%, the likelihood of exploitation is currently very low. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is inferred to be remote, as an attacker would need to supply crafted input to the JToolkit service over the network to trigger the command injection and buffer overflow.