EUVD-2026-100991
GHSA-gc4p-hhhv-c4fx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated local SQL access
-
ExploitSubmit crafted SQL query to TSQLEXE
-
ImpactCrash component causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries in ORM
|
| Exploitation Conditions | Exploitation requires an authenticated, low-privileged user (PR:L) with local access (AV:L) able to submit SQL queries to the HPE NonStop TSQLEXE SQL execution component; the attacker must be able to craft and run a malicious query against that interface. Limiting factors: valid credentials are mandatory (no unauthenticated path), the attack vector is local rather than network-reachable, no user interaction by a victim is needed (UI:N), and the impact is confined to a component crash/availability loss (A:L) with no confidentiality disclosure - there is no indication of remote exploitation or code execution. |
| Impact | This is a genuinely low-priority issue despite being a confirmed vulnerability, and the signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.4 (MEDIUM) is driven by AV:L (local vector), AC:L, PR:L (requires an authenticated low-privilege user) and UI:N, with impact limited to I:L/A:L and no confidentiality impact (C:N) - the realistic outcome is a crash/denial of service of the TSQLEXE component, not code execution or data exposure. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The 'Denial Of Service' tag aligns cleanly with the A:L (and HPE's I:L) impact and the CWE-564 SQL manipulation root cause. No SSVC decision data was provided. The requirement for prior authenticated local access to a specialized NonStop SQL interface sharply limits the realistic attacker population, so this reads as a stability/availability defect for a niche high-assurance platform rather than a widespread exploitation threat. |
| Exploit ScenarioDerived | An authenticated user with low privileges on an HPE NonStop system submits a specially crafted SQL query through the TSQLEXE interface, causing the component to crash and denying service to legitimate database operations. Because the vector is local (AV:L) and requires valid credentials (PR:L), an insider or an attacker who has already obtained a foothold and database access is the realistic actor. No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Application crashes in the HPE NonStop TSQLEXE SQL execution component can be triggered by a crafted SQL query submitted by an authenticated, low-privileged user who already has local access to the system, producing availability loss for that component. The assessed severity is deliberately low (CVSS 3.1 base 4.4; AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L): there is no confidentiality or integrity impact, no victim interaction, and no evidence of a remote, unauthenticated path or of code execution. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS signal is unavailable in the supplied intelligence.
RemediationAI
No fix version is present in the supplied intelligence, so patch status cannot be confirmed from this data alone; treat the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US as the remediation source of record and, where a vendor-supplied TSQLEXE or NonStop corrective firmware/software release is listed there, schedule it through normal HPE support channels and change control. Until that is done, compensating controls should focus on the fact that exploitation requires local, authenticated access: restrict which local accounts may submit ad-hoc SQL queries through TSQLEXE and drive those accounts to least privilege, so a compromised or careless user cannot reach the executor interface (trade-off: reduces analyst and DBA flexibility on shared systems and may slow legitimate batch work). Where operational policy permits, limit interactive SQL submission from non-essential sessions or route query activity through a controlled application layer that validates statement shape before it reaches TSQLEXE (trade-off: application-layer filtering is best-effort and will not block every malformed statement, and overly strict rules can reject valid queries). Enable monitoring and alerting on TSQLEXE process termination plus automated restart or process-pair failover so a crash degrades a single component rather than the workload (trade-off: automatic restart may produce repeated crash/restart loops and can mask the trigger event if logs are not correlated). Audit and retain logs for local logon and query submission so that a crash-triggering statement can be traced back to a specific user, and note that none of these controls removes the root cause - only a vendor fix does that.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE NonStop is a fault-tolerant, Tandem-descended platform whose SQL subsystem includes TSQLEXE, a query execution component that processes SQL statements on behalf of local users and applications. The flaw is a query-handling weakness: a specially crafted statement drives the executor into an unhandled error state that terminates the process, i.e. a local denial-of-service condition rather than data disclosure or privilege gain. The assigned CWE-564 (SQL Injection: Hibernate) sits in the improper-neutralization-of-input-in-SQL family, but it is an imprecise fit for this issue - nothing in the assessed vector (C:N/I:N) supports injection that alters data; the observable effect is availability only (A:L). No CPE identifiers or version ranges were supplied, so the exact build-level exposure of TSQLEXE must be confirmed against HPE's advisory rather than inferred here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Requires authenticated local access to the SQL interface, so AV:L and PR:L; impact is a crash (A:L) with no data exposure, so C:N and I:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB