HPE NonStop Middleware has a flaw in how it handles secret keys and in its deserialization mechanism. The vulnerability falls under CWE‑502, indicating that the software accepts and processes serialized data from untrusted sources without adequate validation. The CVSS score of 7.9 reflects a high severity due to the potential for sensitive data exposure or unauthorized manipulation of system state. While the description does not explicitly state arbitrary code execution, the combination of insecure key handling and raw deserialization can expose critical information and possibly allow an attacker to modify system behavior.

The affected product is Hewlett Packard Enterprise HPE NonStop Middleware. No specific version details are provided in the CVE entry, so all released versions of this middleware should be considered potentially vulnerable until a vendor update is released.

The high CVSS score indicates significant potential impact, but the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in CISA KEV. The likely attack surface is exposed service endpoints that accept serialized data, and remote exploitation would be possible if such endpoints are accessible from untrusted networks. Local exploitation could also be feasible if an attacker gains file‑system access to influence the deserialization process. Organizations should assess network exposure to the middleware and isolate or harden the component where possible.