The vulnerability is a classic input validation flaw that allows an unauthenticated user to execute arbitrary commands through the SQLCAT interface. It is classified as CWE‑20 and carries a CVSS score of 7.4, indicating that the flaw offers a high severity and could compromise the confidentiality, integrity or availability of the affected system.

Hewlett Packard Enterprise’s HPE NonStop SQL/MX SQLCAT is affected. No specific product or version details are listed in the CNA data, so all known releases of the SQL/MX SQLCAT component may be vulnerable until an update is applied.

The EPSS score is below 1 % and the vulnerability is not currently listed in CISA’s KEV catalog, which suggests that the probability of active exploitation is low, but the impact remains high. Because the flaw can be triggered by any unauthenticated user that can reach the SQLCAT service, the likely attack vector is through a network connection to the management interface, and an attacker could gain the ability to run arbitrary commands on the host.