EUVD-2026-100947
GHSA-4ch9-pv46-6qww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged local account on NonStop host
-
DeliverySupply crafted input to Java JToolkit interface
-
ExploitInduce user interaction to trigger processing
-
ExecutionExploit unsanitized input (command injection / buffer overflow)
-
ImpactExecute injected command or corrupt memory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold high local privileges on the HPE NonStop system (PR:H) and to have local access to the JToolkit (AV:L, no network path), plus a separate user must perform an interaction that feeds attacker-controlled input into the vulnerable JToolkit routine (UI:R). The high attack complexity (AC:H) indicates additional non-deterministic conditions - such as specific timing, state, or input shaping - must be met. These factors (local-only, pre-existing high privilege, required second-party interaction, and conditional complexity) sharply limit realistic exploitation and confine impact to the single unchanged security scope (S:U). |
| Impact | All available CVSS signals point to a LOW real-world priority. The vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R (base score 3.8) is about as constrained as an exploitable flaw gets: it requires LOCAL access (AV:L), HIGH attack complexity (AC:H), HIGH existing privileges (PR:H), and user interaction (UI:R), with only Low impact to each of confidentiality, integrity, and availability and no scope change (S:U). No EPSS score, KEV listing, SSVC decision, or public POC was supplied, so there is no exploitation-pressure signal to elevate this above its intrinsically low severity. There is a notable internal tension worth flagging to the vendor: the CWE is CWE-78 (OS command injection) and the tags also claim a buffer overflow, yet the CVSS caps integrity and availability at Low and marks complexity High - command injection and memory corruption often yield higher impact, so either the weakness is heavily mitigated by the required privilege/interaction preconditions or the CVSS impact metrics understate the technical consequence. Net: this is a genuinely low-risk issue (attacker already needs high local privileges and a cooperating user), not a high-CVSS-but-low-real-risk mismatch - the CVSS itself is low and consistent with a constrained, privileged-local flaw. |
| Exploit ScenarioDerived | A locally-authenticated, high-privileged user on an HPE NonStop system coaxes another user into an interaction that passes attacker-influenced input into the Java JToolkit, which fails to sanitize it and either executes an injected OS command or overflows a buffer. The high complexity and user-interaction requirement mean this is not a drive-by; it is a narrow local privilege/abuse path. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Command injection and buffer overflow weaknesses in HPE NonStop Java JToolkit can let a locally positioned, already highly privileged attacker corrupt memory or execute unintended commands within the JToolkit process, with impact limited to low confidentiality, integrity, and availability effects (CVSS 3.1 base 3.8, Low). Exploitation is not remote: it requires pre-existing high local privileges (PR:H), local access to the NonStop system (AV:L), a separate user interaction that supplies attacker-influenced input to the vulnerable routine (UI:R), and additional non-deterministic conditions captured by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), so all available CVSS signals point to a low real-world priority.
RemediationAI
Vendor patch status is not confirmed by the available data; the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US is the authoritative source for the fixed NonStop Java JToolkit release, and administrators should apply that vendor-designated version or its successor once identified rather than assuming a specific build number. Until then, the practical compensating controls follow directly from the assessed vector: because exploitation requires high local privilege (PR:H) and local access (AV:L), restrict interactive and batch access to NonStop hosts running JToolkit to the smallest possible set of trusted administrators, remove unnecessary privileged local accounts, and audit for privilege sprawl, accepting that this does not eliminate the flaw for users who already legitimately hold those rights. Because a second party must feed attacker-influenced input into the vulnerable routine (UI:R) and complexity conditions must align (AC:H), reduce exposure by ensuring JToolkit routines are not driven by untrusted, externally sourced, or user-supplied parameters - sanitize or reject such input at any wrapper or script layer, and disable or avoid JToolkit command-execution utility paths that accept free-form arguments. Because the flaw class includes command injection (CWE-78) and buffer overflow, run JToolkit under a dedicated low-privilege service identity with constrained filesystem and process-execution permissions so that any injected command inherits minimal authority, noting the trade-off that this may break tooling that depends on elevated operations. Monitor NonStop audit and JToolkit logs for anomalous child-process creation or unexpected command invocations from the JToolkit process as a detection backstop, recognizing that this detects rather than prevents exploitation. No public exploit code has been identified at time of analysis, so emergency mitigation is not indicated; however, given the reliance on a vendor bulletin for the fix, verify patching status directly with HPE support rather than assuming the product line is already remediated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is HPE NonStop Java JToolkit, the Java-based tooling layer shipped for the HPE NonStop (Tandem) platform, identified in the CPE data as cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_java_jtoolkit:*:*:*:*:*:*:*:* with an unconstrained version wildcard, meaning the advisory scope is the product line rather than a bounded version range. The root-cause class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS command injection), and the advisory tags also flag a buffer overflow condition alongside the injection issue, so the vulnerable code path both constructs/executes commands without adequate sanitization of externally supplied input and mishandles memory bounds when processing that input. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L confirms the exploitation model: the attack surface is local only (no network vector), the attacker must already hold high privileges on the NonStop host, a second party must trigger the interaction that routes crafted data into the JToolkit routine, and success depends on timing/state/input-shaping conditions that make the outcome non-deterministic. Because the scope is unchanged (S:U), any command execution or memory corruption remains confined to the security authority of the already-privileged local context rather than escalating to the host, the OS, or other components.
Know when Hpe Nonstop Java Jtoolkit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Flaw needs local access with high pre-existing privileges and victim interaction under non-trivial conditions, so AV:L/PR:H/UI:R/AC:H; impacts stay Low per the constrained, scope-unchanged context.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB