The vulnerability allows an attacker to obtain confidential certificate data from the HPE Morpheus appliance. Exposure of these certificates can enable attackers to spoof the appliance, decrypt traffic, or gain privileged access. The weakness is an information disclosure flaw where private key material or certificate details are inadvertently exposed, potentially compromising confidentiality, integrity, and authenticity of communications.

The affected product is the HPE Morpheus manager software, deployed as an appliance in data center environments. No specific versions or build numbers are included in the advisory, so all currently supported configurations should be inspected for the presence of the vulnerability.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, making the exact likelihood of exploitation uncertain; however, the absence of a KEV listing suggests no known active exploitation yet. Likely attack paths involve remote access to the management interface or API endpoints that expose certificate information from configuration files or memory dumps. Given its severity, successful exploitation could lead to significant confidentiality and integrity risks.