AutoPass License Server CVE-2026-23600

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N, so there are no special conditions beyond network reachability - remote unauthenticated exploitation against HPE AutoPass License Server with no user interaction and low attack complexity. The primary limiting factor is network exposure: APLS is frequently deployed as an internal licensing service, so instances confined to trusted management networks are far less exposed than any that are internet- or DMZ-reachable. Exact affected versions are not specified in the provided data (CPE version is a wildcard), so version-based limits should be confirmed against HPE bulletin hpesbgn05003en_us.

The signals are partially conflicting and warrant careful reading. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact) describes the worst-case profile: network-reachable, low-complexity, no authentication, no user interaction, full compromise - which is why it scores 10.0. Against that, the EPSS score is low (0.24%, 46th percentile), the vulnerability is not on the CISA KEV list, and no public exploit has been identified, so there is currently no evidence of active or automated exploitation. A licensing server is often internal-facing, which reduces exposure, but where APLS is reachable from untrusted networks the pre-auth full-compromise nature means any operator - even a mid-sized municipal IT team in gdynia running it on an internet-exposed host - should treat patching as urgent rather than routine. Net assessment: genuinely high-priority for internet- or DMZ-exposed instances given the pre-auth maximal impact, but the low EPSS and absence of KEV/POC suggest the threat is presently latent rather than under mass exploitation.

An attacker who can reach the APLS service over the network sends a crafted request that the server accepts without valid credentials, bypassing authentication and obtaining administrative access to the licensing platform. From there the attacker can read or alter licensing data and leverage the server's trusted position to affect connected HPE products. No public exploit code has been identified, so this scenario is currently theoretical based on the CVSS network/low-complexity/no-privilege profile.