HPE IceWall CVE-2026-73784

Exploitation requires a network-reachable HPE IceWall deployment with SAML federation actively configured and in use (IceWall acting as a service provider or identity provider). The attacker must hold at least a low-privilege authenticated account within the federation (PR:L per CVSS) sufficient to obtain a legitimate SAML response that can then be tampered with. No victim user interaction is required (UI:N). Environments that do not use IceWall's SAML federation feature are not exposed to this specific vector. Exploitation is constrained to the scope of the SAML-protected applications federated with the vulnerable IceWall instance.

The CVSS 8.8 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H correctly identifies network reachability and low complexity, but the A:H metric appears overstated for a signature-bypass impersonation attack that does not inherently disrupt service availability - the real impact is confidentiality and integrity through identity spoofing. Even a mid-sized municipal IT team in radom relying on IceWall for SSO should treat this as urgent, since successful exploitation grants full access to resources protected by the impersonated user's identity across all federated applications. EPSS score and KEV status are absent from the provided intelligence, preventing exploitation probability quantification. The 'Jwt Attack' tag alongside a SAML-focused description introduces ambiguity - it is unclear whether the advisory covers a second JWT-based vector or whether the tag reflects imprecise labeling. No public exploit has been identified at time of analysis, but SAML signature bypass attacks are well-documented in the research literature and straightforward to execute once the vulnerable behavior is confirmed.

An attacker holding a low-privilege account in the federated identity environment intercepts or obtains a valid SAML response issued by the identity provider, modifies the Subject element to assert a high-privilege target user's identity, and submits the tampered assertion to the IceWall service provider. Because IceWall improperly verifies the SAML signature, it accepts the forged assertion and grants the attacker a session as the impersonated user. No public exploit code has been identified at time of analysis, but the attack technique mirrors well-documented SAML wrapping and signature-exclusion attacks.