HPE NonStop TCP/IP CVE-2026-76659

Exploitation requires that the finger daemon component of HPE NonStop TCP/IP UTILITIES is actually running and its finger port is network-reachable by the attacker; finger is a legacy service often disabled or firewalled in modern deployments, which is the primary limiting factor. The affected software must be at version T8602L01^BAA or earlier. No authentication, credentials, user interaction, or special client configuration is needed once the service is exposed (AV:N/AC:L/PR:N/UI:N), but the blast radius is limited to availability of the service on the NonStop host - no data disclosure or modification results.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a cleanly remote, low-complexity, unauthenticated availability-only attack, which is internally consistent with the description of an unauthenticated remote DoS in the finger daemon. However, several exploitation-pressure signals are entirely absent: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is therefore a genuinely network-reachable, no-auth weakness on paper, but its real-world urgency is tempered by the fact that the impact is confined to availability (no confidentiality or integrity loss, scope unchanged) and the affected platform (HPE NonStop) is a niche, fault-tolerant mainframe-class system with a small, specialized deployment footprint. Note a conflicting metadata signal: the issue is tagged 'Authentication Bypass' and mapped to CWE-306 (Missing Authentication), yet the only stated consequence is denial of service, not unauthorized access - treat the 'bypass' framing with caution and verify against the HPE advisory. Net assessment: a legitimate patch-worthy availability bug for NonStop operators exposing finger, but not a mass-exploitation priority relative to CVSS-matched flaws on ubiquitous software.

A remote attacker with network reachability to a NonStop host running the finger daemon sends a crafted or malformed finger request to the listening service without any credentials. Because the service requires no authentication (PR:N) and the attack is low-complexity (AC:L), the malformed input triggers a fault that renders the finger service - and potentially dependent TCP/IP utility functionality - unavailable. No public exploit code is known, so an attacker would need to develop the triggering request themselves.