Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local `core.hooksPath` setting in `.git/config` without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. No active exploitation has been identified (EPSS 0.13%, not in CISA KEV); a code-level fix exists in GitHub PR #22843 but a versioned patch release is not independently confirmed at time of analysis.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions up to and including 2.12.1) allows unauthenticated attackers to inject arbitrary JavaScript via the guest checkout form's 'custom_order' parameter. The payload is persisted in the WordPress database without sanitization and fires inside the WordPress admin panel when an administrator reviews the affected order - a routine operational workflow requiring no social engineering of the victim. Upgrade to version 2.12.2 is indicated by plugin Trac changeset history; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Stored XSS in the Affiliate Super Assistent WordPress plugin (≤ 1.10.2) enables unauthenticated attackers to inject persistent JavaScript payloads via the doCommentShortcode function in AsaCore.php, which executes in the browser of any visitor loading an affected page. The vulnerability carries a CVSS 7.2 (High) score reflecting network accessibility, no authentication requirement, and scope change to the victim browser context. No active exploitation or public PoC has been identified at time of analysis; an upstream fix commit (changeset 3672410) is available via the WordPress plugin repository.
Stored Cross-Site Scripting in the Listdom WordPress plugin (all versions through 5.8.1) allows unauthenticated attackers to inject persistent malicious scripts via the `lsd[displ][style]` parameter, with payloads executing in every subsequent visitor's browser upon page load. The CVSS PR:N rating confirms no authentication is required to plant the payload once the vulnerable parameter is reachable. Wordfence identified the vulnerable code across four paths - single.php (lines 82 and 560), dashboard.php (line 739), and listing.php (line 196) - and a Trac changeset suggests a code-level fix was committed, though an explicit patched release version number is not confirmed in available data. No public exploit identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Authenticated IDOR in GROWI through v8.0.2 exposes revision content from access-restricted pages via the GET /_api/v3/revisions/:id API endpoint. The endpoint performs its access check against a caller-supplied query parameter (page identifier) but returns the revision record identified by the URL path parameter without verifying both identifiers resolve to the same page. Any authenticated user can pair a page ID they legitimately access with an arbitrary revision ID from a private or restricted page to silently exfiltrate its historical content. No public exploit is identified at time of analysis; CVSS 4.0 scores this 7.1 with high confidentiality impact and no integrity or availability loss.
Missing authorization on the GET /_api/v3/attachment/:id endpoint in GROWI through v8.0.2 allows any authenticated user to retrieve attachment metadata - including original filenames and file formats - from pages they have no permission to view. The root cause (CWE-862) is an omitted page-viewer access check that the sibling /attachment/list endpoint already enforces, confirmed by VulnCheck and the upstream patch PR. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially mounted by any valid GROWI session holder who can enumerate attachment identifiers.
Stored XSS across multiple legacy PHP templates in LibreNMS allows an attacker who controls a monitored network device to inject arbitrary JavaScript via SNMP-polled fields (ifAlias, mempool_descr, storage_descr, sensor_descr) or syslog program fields, with payload execution triggered when any authenticated LibreNMS user browses alerts, health dashboards, or syslog views. The vulnerability spans at least five distinct template locations and stems from inconsistent output encoding - adjacent fields in the same code paths are correctly escaped, but affected fields are not. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high confidentiality impact from potential session token theft makes patching a priority for any network operations team.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Missing authorization in Elasticsearch's custom inference service allows a low-privileged user holding only inference execution rights to redirect outbound inference traffic to an attacker-controlled endpoint, causing administrator-provisioned credentials to leak to that destination. Affected across the 8.x and 9.x branches (Elasticsearch 8.0.0 through 8.19.18, 9.0.0 through 9.3.7, 9.4.0 through 9.4.3, and 9.5.0), this is a privilege-abuse path where an underprivileged internal user effectively hijacks admin-level secrets without requiring elevated permissions. No public exploit or active exploitation has been identified; EPSS sits at 0.17% and SSVC rates technical impact as partial.
Cross-Site Request Forgery in Talassoft Industrial Management Software (versions V.4 through V.15) enables a remote unauthenticated attacker to induce an authenticated user's browser to submit unauthorized state-changing requests to the application. The high integrity impact (I:H per CVSS) indicates that successfully forged requests can alter industrial management data or configurations without the victim's knowledge. No public exploit code or CISA KEV listing is identified at time of analysis; the vulnerability was disclosed by Turkey's national cybersecurity authority (USOM).
Command injection in rpm's `rpmuncompress` utility allows a local attacker who can place a crafted `.gem` file containing RPM macro syntax to execute arbitrary commands with the privileges of the invoking user or automated workflow. The vulnerability arises because the macro expansion engine processes the gem filename during command construction without sanitization, meaning any RPM macro embedded in the filename is evaluated at execution time. No public exploit code has been identified at time of analysis; the CVSS 7.0 score reflects full CIA impact constrained by local attack vector and required user interaction.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.
DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog.
Insecure installation directory permissions in Rockwell Automation ControlFLASH™ expose any local user account to arbitrary code execution by allowing write access to the product's installation folder for the Windows 'Everyone' group. An attacker with low-privileged local access can plant a malicious binary or DLL in the installation directory, which then executes at the permission level of whichever user subsequently launches ControlFLASH - potentially a privileged operator in an OT environment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Availability degradation in Erlang/OTP stdlib's URI parser allows any remote, unauthenticated attacker to stall an Erlang process for hundreds of milliseconds by supplying a URI whose port field contains an arbitrarily long run of digits. The function uri_string:parse/1 - the documented, standard interface for URI parsing in OTP - routes all authority forms through get_port/1, which calls binary_to_integer/1 with no length bound; a syntactically valid port of approximately 1.26 million digits converts successfully, burning CPU on arbitrary-precision arithmetic without raising an error. Affected OTP versions span releases 21.0 through the 27.x, 28.x, and 29.x trains; vendor-released patches are available, and no public exploit or active exploitation has been confirmed at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
Server-side request forgery in Kyverno's Service Call feature (versions before v1.13.4) allows any cluster user holding ClusterPolicy creation rights to exfiltrate arbitrary Kubernetes resource data - including Secrets - by directing policy apiCall requests to an attacker-controlled external server. The vulnerability stems from a missing URL validation that permits the apiCall/service block, documented for in-cluster services, to resolve and POST data to internet-accessible endpoints. Publicly available exploit code exists in the form of a working PoC ClusterPolicy published in the GHSA advisory; no active exploitation is confirmed via CISA KEV.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Server-side request forgery in Kyverno's APICall feature (all versions before 1.16.2) enables any user holding namespace-level Policy creation rights to weaponize Kyverno's cluster-wide, high-privilege ServiceAccount as a confused deputy - directing it to issue HTTP requests to arbitrary internal endpoints including cloud IMDS at 169.254.169.254. Responses, potentially containing other tenants' database passwords, API keys, and cloud IAM role credentials, are surfaced in the PolicyReport and are readable by the attacking tenant, completely collapsing multi-tenant isolation. No public exploit has been identified at time of analysis, though the attack path is straightforward and the impact in shared Kubernetes clusters is severe.
Server-side request forgery in Wyoming before 1.10.2 allows unauthenticated network-accessible attackers to redirect outbound connections from the server to arbitrary attacker-chosen hosts. The HTTP API accepted an unvalidated `uri` query parameter across multiple endpoints - including `/api/info`, `/api/speech-to-text`, and `/api/text-to-speech` - enabling full override of the server-configured backend URI with arbitrary `tcp://` or `unix://` targets. No public exploit has been identified at time of analysis, but the attack requires only a crafted HTTP request with no authentication.
Path traversal in appium-mcp-server through 0.1.61 allows any caller of the write_file or write_files_batch MCP tools to overwrite arbitrary files on the host system by supplying absolute paths or parent-directory sequences (../) that escape the intended PROJECT_ROOT boundary. The server user's full filesystem write permissions are exposed, enabling an attacker to corrupt shell profiles, inject cron jobs, or overwrite application configuration files. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable given the absence of any path validation logic in the affected tools.
Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Stored cross-site scripting vulnerabilities in Rockwell Automation's ArmorStart® LT distributed motor controller expose industrial operators to persistent script injection via the device's embedded web management interface. Per the CVSS 4.0 AV:N/PR:N vector, unauthenticated remote attackers can inject malicious scripts that are persisted on the device and execute in the browsers of any operator or engineer who subsequently accesses affected pages - enabling session hijacking, credential theft, or display of falsified operational data. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the ICS context meaningfully elevates practical risk beyond the moderate base score.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Access control bypass in the HPE AOS-CX API endpoint allows a highly-privileged remote attacker to circumvent the device's configured access control policy and reach management functionality that should be restricted to a higher administrative tier. Affected devices include HPE switches running AOS-CX, as confirmed by HPE in advisory hpesbnw05134, which also covers four other AOS-CX CVEs in the same release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authenticated path traversal in HPE AOS-CX's web-based management interface permits a low-privileged authenticated attacker to read arbitrary files from the underlying operating system, potentially exposing credentials, private keys, and device configuration data. The CVSS vector (AV:N/AC:L/PR:L) confirms the vulnerability is remotely exploitable with minimal complexity once valid credentials are obtained. This CVE is part of a broader HPE security advisory (hpesbnw05134) covering multiple AOS-CX vulnerabilities, including higher-severity unauthenticated RCE issues, making credential exposure via this flaw a plausible stepping-stone in a multi-stage attack chain. No public exploit identified at time of analysis.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.