HPE NonStop EXPAND CVE-2026-76664

Exploitation targets the HPE NonStop EXPAND networking subsystem (the component that interconnects NonStop systems) and requires an adjacent-network position (AV:A) - the attacker must be on the same logical/physical network segment, not the open internet. No authentication (PR:N) and no user interaction (UI:N) are needed, but high attack complexity (AC:H) means success depends on specific, attacker-uncontrolled conditions such as memory state or timing when sending malformed EXPAND traffic. The primary limiting factors are the adjacent-network reachability requirement and the high complexity, which together narrow realistic exploitation to attackers who already have network proximity to a NonStop deployment.

This is a moderate-severity issue (CVSS 6.4) rather than an urgent emergency. The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N tells a mixed story: exploitation requires no authentication (PR:N) and no user interaction (UI:N), but it is constrained to an adjacent-network position (AV:A) and carries high attack complexity (AC:H), meaning an attacker needs favorable conditions or specific timing to succeed. Impact is skewed toward availability (A:H) with only low confidentiality and integrity (C:L/I:L), consistent with an out-of-bounds read/write (CWE-125) that most reliably produces crashes or limited memory disclosure rather than clean code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net judgment: a legitimate patch-management priority for the specific population running HPE NonStop EXPAND, but not a drop-everything issue given the adjacent-network requirement, high complexity, and absence of exploitation signals.

An attacker with a foothold on the same network segment as a NonStop system sends malformed traffic to the EXPAND networking subsystem, triggering an out-of-bounds read or write. Because the flaw favors availability impact (A:H), the most realistic outcome is service disruption or a process crash, with possible limited memory disclosure. No public exploit code is known, and the high attack complexity (AC:H) means reliable exploitation would require specific conditions rather than a trivial single packet.