Which versions of AutoPass License Server are affected by CVE-2026-23600?

HPE AutoPass License Server is vulnerable to a critical, unauthenticated remote authentication bypass (CVE-2026-23600, CVSS 10.0) that grants full administrative control to attackers on the licensing…

How to fix or mitigate CVE-2026-23600?

Within 24 hours: immediately restrict network access to HPE AutoPass License Server to authorized administrative networks and disable any non-essential remote access capabilities. Within 7 days: engage HPE support to confirm your APLS version and assess whether any out-of-band mitigations or interim patches are available; implement enhanced logging and real-time alerting to detect unauthorized administrative access or license modifications on APLS. Within 30 days: prepare a detailed incident response plan for licensing service compromise, implement network segmentation to isolate APLS from general IT infrastructure, and closely monitor HPE security advisories for official patch availability and deployment procedures.

AutoPass License Server CVE-2026-23600

Q: What is the CVSS score of CVE-2026-23600?

CVE-2026-23600 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Improper Authentication (CWE-287)

2026-03-02 security-alert@hpe.com

Authentication Bypass Autopass License Server Hpe

10.0

CVSS 4.0 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Pre-auth network authentication bypass (PR:N/AC:L) with full impact reaching connected systems justifies S:C and C:H/I:H/A:H, matching the vendor's maximal score.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 20:22 NVD

10.0 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 15:16 cve.org

CRITICAL 10.0

CVE Published

Mar 02, 2026 - 15:16 nvd

N/A

DescriptionCVE.org

A remote authentication bypass vulnerability

exists in HPE AutoPass License Server (APLS).

AnalysisAI

Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumvent access controls and gain full administrative control over the licensing service, per HPE advisory hpesbgn05003en_us. The flaw (CWE-287, improper authentication) carries a maximum CVSS 4.0 base score of 10.0 with high confidentiality, integrity, and availability impact extending to subsequent systems. No public exploit identified at time of analysis, and the EPSS probability is currently low (0.24%).

Technical ContextAI

HPE AutoPass License Server is a centralized software-licensing component that HPE bundles with numerous enterprise, network, and telecom management products to issue and validate product entitlements. The root cause is classified as CWE-287 (Improper Authentication), meaning the server accepts requests or sessions as trusted without correctly verifying the requester's identity - an authentication bypass rather than a credential-cracking or privilege-escalation issue. The affected component per the CPE string cpe:2.3:a:hpe:autopass_license_server covers all versions (wildcard), indicating the vendor has not scoped the flaw to a narrow build range in the machine-readable data.

RemediationAI

Patch available per vendor advisory: apply the fixed AutoPass License Server release identified in HPE security bulletin hpesbgn05003en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn05003en_us&docLocale=en_US); the exact fixed version is not present in the supplied data and must be taken from that advisory. Until the patched build is deployed, restrict network reachability of the APLS management and licensing ports to trusted management subnets only and remove any internet or DMZ exposure, since the flaw is remotely reachable and requires no authentication - the trade-off is that legitimate remote clients or distributed products relying on the license server must be whitelisted or routed through the trusted segment to avoid licensing outages. Place the server behind a VPN or firewall ACL and monitor authentication and administrative activity on the service for anomalous access as a detective compensating control.