NonStop TCP/IP Utilities CVE-2026-76656

Exploitation requires that traceroute be executed under unspecified 'certain conditions' within HPE NonStop TCP/IP Utilities (version T8602L01^BAA and earlier); the vendor description does not name the exact configuration or runtime state, which is itself a limiting factor. The CVSS vector confirms the key constraints: high attack complexity (AC:H) meaning a specific, not-always-present condition must be met, and required user interaction (UI:R) meaning the traceroute action/operator step must occur - the attacker cannot trigger it unilaterally. No authentication is required (PR:N), and impact is limited to availability only (A:H; C:N/I:N), so no data exposure or code execution results. Exposure is further limited to environments running the affected NonStop TCP/IP Utilities with reachable traceroute functionality.

This is a moderate-severity denial-of-service issue (CVSS 5.3) whose signals point toward low real-world urgency. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) shows network reach and no privileges, but exploitation is gated by high attack complexity (AC:H) and required user interaction (UI:R) - the flaw only manifests 'when traceroute is executed under certain conditions,' which is consistent with the AC:H/UI:R rating. Impact is confined to availability (A:H) with no confidentiality or integrity effect. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation-likelihood signals are absent or negative - no evidence of prioritized, widespread exploitation. One inconsistency should be flagged: the CWE-306 (Missing Authentication) classification and the 'Authentication Bypass' tag do not align with the described impact, which is purely a denial of service with no authentication-bypass or data-access consequence - treat the auth-bypass framing as unreliable and rely on the DoS description. On balance this is a high-CVSS-relative-to-impact DoS in a niche platform, not a drop-everything priority; patch during normal maintenance cycles.

A remote, unauthenticated attacker interacts with an HPE NonStop system running the affected TCP/IP Utilities such that a traceroute operation is triggered under the specific condition that exercises the flaw, causing the networking service or utility to crash and denying availability. Because the CVSS vector specifies high attack complexity and required user interaction, the attacker cannot reliably trigger this on demand and likely depends on an operator action or a particular runtime state. No public proof-of-concept exploit was identified at time of analysis.