Description
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
Published: 2026-10-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The finger daemon in HPE NonStop TCP/IP UTILITIES is vulnerable to unauthenticated remote input that can cause the daemon to fail or consume excessive resources, resulting in a denial of service for legitimate users. This weakness is a classic authentication bypass (CWE-306) that allows an attacker to interrupt critical networking utilities without requiring credentials.

Affected Systems

The flaw affects Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES. No specific product versions are listed in the data provided.

Risk and Exploitability

The CVSS score of 7.5 labels the vulnerability as high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating no known public exploitation yet. The attack vector is inferred to be remote, relying on the finger service available over the network. An unauthenticated attacker could craft a malformed request to trigger a crash or resource exhaustion, leading to a sustained service interruption.

Generated by OpenCVE AI on October 15, 2026 at 11:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest HPE NonStop TCP/IP UTILITIES patch that addresses the finger daemon issue.
  • Upgrade the system to a version where the vulnerability has been fixed if an update is available.
  • If patching is delayed, block external access to the finger service via firewall rules to prevent remote exploitation.

Generated by OpenCVE AI on October 15, 2026 at 11:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe nonstop Tcp/ip Utilities
Vendors & Products Hpe
Hpe nonstop Tcp/ip Utilities

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
Title HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Hpe Nonstop Tcp/ip Utilities
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-15T15:23:46.938Z

Reserved: 2026-08-19T16:10:37.083Z

Link: CVE-2026-76659

cve-icon Vulnrichment

Updated: 2026-10-15T15:23:43.468Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T02:20:15.897

Modified: 2026-10-15T16:23:06.250

Link: CVE-2026-76659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:23:35Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function