What is the CVSS score of CVE-2026-63457?

CVE-2026-63457 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-63457?

Yes, a patch is available for CVE-2026-63457. Update the affected software to the latest version immediately.

HPE iLO 6 CVE-2026-63457

EUVD-2026-53548 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-08-05 hpe

GHSA-mhj7-9x79-vrjv

Denial Of Service Hpe Integrated Lights Out 6 Ilo 6 Hewlett Packard Enterprise Hpe

6.5

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Adjacent-only access (AV:A) limits reach; no auth or complexity required; impact is purely availability disruption with no confidentiality or integrity effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 05, 2026 - 19:18 EUVD

Analysis Generated

Aug 05, 2026 - 18:45 vuln.today

DescriptionCVE.org

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.

AnalysisAI

Denial of service in HPE Integrated Lights-Out 6 (iLO 6) firmware prior to v1.78 allows an unauthenticated attacker on an adjacent network segment to render the management interface unavailable. The impact is limited to availability (A:H) with no confidentiality or integrity compromise, but disrupting iLO can blind administrators to server state and block out-of-band recovery operations during incidents. No public exploit or active exploitation has been identified at time of analysis; HPE has released v1.78 as the fix.

Technical ContextAI

HPE Integrated Lights-Out (iLO) is a dedicated out-of-band management processor embedded on HPE ProLiant servers, providing remote console, power control, health monitoring, and virtual media even when the host OS is offline. iLO 6 is the generation shipped with HPE Gen11 ProLiant servers. The management interface exposes its own network stack independent of the host OS, making it a distinct attack surface reachable via a dedicated management NIC or shared NIC in shared-network mode. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_integrated_lights-out_6_(ilo_6):*:*:*:*:*:*:*:* covers all iLO 6 versions preceding v1.78. No CWE was assigned, so the precise root-cause class (e.g., resource exhaustion, unhandled input, memory mismanagement) is unconfirmed from available data.

RemediationAI

Upgrade HPE iLO 6 firmware to version v1.78 or later, as documented in HPE Security Bulletin HPESBHF05090 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf05090en_us&docLocale=en_US. Firmware updates can be applied online via the iLO web interface, the HPE iLO Amplifier Pack, or offline via SPP (Service Pack for ProLiant). As a compensating control prior to patching, restrict network access to the iLO management interface to only authorized management hosts using ACLs or firewall rules at the management VLAN boundary - this eliminates the adjacent-network exposure entirely. If iLO is currently on a shared production network rather than a dedicated management VLAN, migrating it to an isolated segment reduces attack surface beyond just this CVE. Note that restricting iLO network access may impact monitoring tools and automation that rely on iLO connectivity.