HPE NonStop SOAP EUVD-2026-101859

Exploitation requires network reachability to the HPE NonStop SOAP 4.0 web-services listener and the ability to submit a malicious SOAP request that the service parses; per CVSS PR:N/UI:N no authentication or user interaction is needed against a reachable endpoint. The principal limiting factor is exposure: NonStop SOAP services are typically deployed in restricted, internal mission-critical back-office environments (finance, telecom, retail switching) rather than on the public internet, so realistic risk depends heavily on whether the SOAP endpoint is network-accessible to the attacker. Impact is confined to a crash/system-down condition (A:H) with limited integrity effect (I:L) and no confidentiality exposure based on the vendor vector.

This is a moderate-priority availability issue rather than a top-tier emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:H, 8.2 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw whose dominant impact is availability (A:H, system down) with only limited integrity impact (I:L) and no confidentiality loss (C:N) - consistent with the description of memory corruption causing a crash rather than code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or probable near-term exploitation; the high base score is driven by easy reachability and a denial-of-service outcome, not by demonstrated weaponization. One tension to verify: the input Tags label this a 'Buffer Overflow' and the description says 'memory corruption,' which often implies potential for code execution, yet both the CWE (CWE-20, improper input validation) and the C:N/I:L impact metrics point to a crash/DoS rather than RCE - if the vendor advisory indicates controllable corruption, the integrity/confidentiality impact could be understated. Overall, treat as a patch-soon availability risk for exposed NonStop SOAP endpoints, not a confirmed exploited threat.

A remote, unauthenticated attacker sends a crafted SOAP request to an exposed HPE NonStop SOAP 4.0 service endpoint, triggering memory corruption in the request-parsing path. The malformed input crashes the service and brings the system down, causing a denial of service against the fault-tolerant NonStop environment. No public exploit code was identified at time of analysis, and the primary realistic outcome is service disruption rather than code execution.