HPE NonStop SQLCAT CVE-2026-79834

Requires network reachability to the HPE NonStop SQL/MX SQLCAT (SQL/MX catalog manager) component, which must process attacker-supplied input that is improperly validated (CWE-20) to achieve unauthorized command execution. The CVSS vector sets PR:L, implying a low-privileged authenticated account is needed and no user interaction (UI:N); however the HPE description states an UNAUTHENTICATED user can exploit it, so the true access prerequisite is unresolved and should be confirmed against HPE advisory hpesbns05148en_us. Limiting factors: exploitation is confined to environments running HPE NonStop (a specialized fault-tolerant platform, not general-purpose), and exposure depends on whether the SQLCAT service is network-accessible rather than restricted to a management segment.

This is a medium-to-high severity issue (CVSS 7.4) with a notable internal contradiction that must be resolved before prioritization. The NVD/vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity flaw requiring LOW privileges (PR:L = an authenticated but low-privileged account), yet the HPE description explicitly states 'an unauthenticated user' can perform unauthorized command execution - and the input Tags include 'Authentication Bypass'. These two signals conflict: if the description is correct this is effectively PR:N (fully unauthenticated) and the real-world risk is higher than the 7.4 suggests; if the CVSS vector is correct it requires some prior access. VERIFY WITH VENDOR (HPE advisory hpesbns05148en_us). On the exploitation-likelihood side, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) plus command-execution semantics mean impact can cross a trust boundary, but the per-impact ratings are only Low (C:L/I:L/A:L), tempering the 'command execution' framing. Net: a credible flaw worth patching on HPE NonStop systems (which run mission-critical workloads), but not a drop-everything emergency absent exploitation signals - the unauthenticated-vs-PR:L ambiguity is the single most important thing to confirm.

An attacker with network reachability to the HPE NonStop SQL/MX SQLCAT (SQL catalog) service sends crafted, improperly-validated input to trigger unauthorized command execution across a scope boundary. The HPE description implies no authentication is needed, though the CVSS vector indicates a low-privileged account may be required - this gap should be confirmed. No public proof-of-concept exploit was identified at time of analysis.