HPE NonStop EXPAND CVE-2026-76665

Exploitation requires network adjacency to a NonStop system running the EXPAND networking subsystem - the attacker must be able to reach the EXPAND communication path on the same logical/adjacent network (AV:A), not arbitrary internet access. No authentication is required (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H) means success depends on specific, hard-to-control conditions such as timing/state of the EXPAND process, which significantly limits reliable exploitation. Practical risk is further bounded by the platform's limited deployment footprint and by network segmentation typically placing EXPAND links on controlled internal/interconnect networks.

This is a moderate-priority issue rather than an urgent one, and the signals are internally consistent but modest. The vendor CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H, base 7.1 HIGH) describes an adjacent-network (AV:A), high-complexity (AC:H), unauthenticated (PR:N) attack with no user interaction, yielding limited confidentiality loss but high integrity and availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active exploitation or an available exploit - exploitation status is 'no public exploit identified at time of analysis.' The combination of adjacent-only reachability plus high attack complexity materially lowers real-world risk: an attacker must already have a foothold on the same logical network segment as the EXPAND link and win a difficult race/condition-dependent path. One conflict worth flagging: the CWE is CWE-125 (out-of-bounds READ) and the description leads with 'out-of-bounds memory read,' yet the vector asserts I:H/A:H and the text also says 'resulting in buffer overflow' - a pure OOB read does not normally grant high integrity impact, so the integrity rating and the read-vs-write nature should be verified against the HPE advisory (hpesbns05148en_us). Net: a legitimate HIGH to patch on a maintenance cadence, not a drop-everything emergency, given niche deployment, adjacent vector, and high complexity.

An attacker with access to the same adjacent network as an HPE NonStop system sends specially crafted traffic over the EXPAND networking subsystem to trigger an out-of-bounds memory read. Because attack complexity is high (AC:H), the attacker must satisfy specific timing or state conditions, but success can leak limited memory contents and corrupt/crash the EXPAND process, degrading the fault-tolerant node. No public exploit code is known at the time of analysis.