A remote code execution vulnerability has been identified in HPE Morpheus Software. The flaw permits an attacker to execute arbitrary code with the privileges of the affected system, potentially leading to full system compromise, data exfiltration, or lateral movement. The issue is that the flaw allows malicious code to run on the host, but the precise technical root cause is not described in the available information.

The vulnerability affects HPE Morpheus Software. No specific version or build numbers are disclosed in the vendor advisory, so any deployment of Morpheus, regardless of the version, may be susceptible until a vendor patch is applied. Operators should verify their installed version against the vendor’s guidance.

The CVSS score of 8.8 classifies the flaw as high severity, indicating that exploitation could have a major impact on confidentiality, integrity, and availability. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the flaw suggests that attackers may target exposed instances of Morpheus, particularly those reachable via the Internet or cloud networks. The likely attack vector is remote access, based on the description of the vulnerability as a remote code execution flaw. Immediate security measures such as patching or restricting external access remain prudent.