HPE NonStop OCAX CVE-2026-79826

Exploitation requires pre-existing local access to an HPE NonStop system with at least low-privilege credentials (PR:L) and the ability to send input to the OCAX component; it is not remotely reachable over the network (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the local-access and authentication prerequisites are the primary limiting factors. The description does not name a specific non-default configuration or feature toggle, so the condition is effectively: an authenticated local actor able to invoke/feed OCAX. Realistic exposure is therefore limited to insiders or attackers who have already compromised a low-privilege account on the platform.

This is a medium-severity, authenticated LOCAL vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, 7.1) is internally consistent: an attacker who already has low-privilege local access to the HPE NonStop OCAX environment can, with low complexity and no user interaction, trigger a heap overflow yielding high integrity and availability impact but no confidentiality loss (C:N). The signals are notably thin - there is NO EPSS score, NO CISA KEV listing, and NO published proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC combined with AV:L and PR:L strongly argues against widespread opportunistic exploitation; realistic risk is confined to environments where an attacker has already obtained a foothold with local credentials. No SSVC decision data was supplied. The I:H/A:H with 'may potentially redirect execution flow' language suggests code-execution potential, but the vendor hedges ('could', 'may potentially'), so the integrity/availability impact is plausible but not confirmed as reliable RCE. Net: a real but not urgent issue - patch on normal cadence, prioritize higher where NonStop hosts sensitive workloads and local account hygiene is weak.

An attacker who already holds a low-privilege local account on an HPE NonStop system interacts with the OCAX component and submits oversized or malformed input that overflows a heap-allocated buffer. The corruption damages adjacent address space and may let the attacker redirect execution flow to gain elevated code execution or crash the service. No public exploit code is identified at time of analysis, so this would require original exploit development.