EUVD-2026-102009
GHSA-xpvr-q7rw-ww5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SQLUTIL service over network
-
DeliverySend malformed/crafted request
-
ExploitTrigger uncaught exception (CWE-248)
-
ExecutionService terminates unexpectedly
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires network reachability to the HPE NonStop ANSI SQLUTIL service; the CVSS vector (PR:N/UI:N/AC:L) indicates unauthenticated exploitation with no user interaction and low complexity against a reachable instance. The key limiting factor is exposure scope: SQLUTIL is a component of the specialized NonStop SQL/MX platform, so realistic risk depends on whether that service is network-accessible to untrusted actors rather than restricted to internal/administrative networks. Impact is limited to availability (service termination/restart); there is no confidentiality or integrity effect, and specific affected versions must be confirmed from HPE bulletin hpesbns05148en_us. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with impact confined entirely to availability (C:N/I:N), consistent with CWE-248 (Uncaught Exception) and the vendor-assigned 'Denial Of Service' tag - the signals are internally coherent with no network-vs-local contradiction. However, the exploitation-likelihood signals are absent, not reassuring: no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. The practical risk is therefore moderated by the target itself: HPE NonStop is a specialized fault-tolerant platform with a small deployment footprint, and the impact is a service crash only - no data compromise or code execution. Net assessment: a legitimately network-exploitable availability bug that matters acutely to the few organizations running NonStop SQL services exposed to untrusted networks, but it is not a broad, mass-exploitation priority. Treat the 7.5 as 'high within affected estates' rather than internet-wide urgency; no SSVC decision data was supplied, so automatability and exploitation maturity cannot be confirmed. |
| Exploit ScenarioDerived | An attacker with network reachability to an HPE NonStop system running the ANSI SQLUTIL service sends a crafted or malformed request that triggers an unhandled exception, causing the service to terminate unexpectedly. No authentication or user interaction is required, so any party that can reach the listening service can repeatedly crash it to deny availability. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated remote attackers can cause the HPE NonStop ANSI SQLUTIL service to terminate unexpectedly, producing a denial-of-service condition on the targeted system. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable at low complexity with no credentials or user interaction required, and its impact is confined entirely to availability - there is no confidentiality or integrity effect. Root cause is classified as CWE-248 (Uncaught Exception), consistent with an unhandled error path that aborts the SQLUTIL process; no public exploit code has been identified at time of analysis, and the practical risk depends heavily on whether the SQLUTIL service is exposed to untrusted networks rather than restricted to internal administrative segments, since the affected component is part of the specialized HPE NonStop SQL/MX platform.
RemediationAI
No vendor-released patch version is identified in the available data; the authoritative source is the HPE security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US), which should be consulted for the confirmed affected version matrix and the fixed release or patch set (HPE NonStop fixes are typically delivered as SPRs or product updates). Until that fix is applied, the most effective compensating control is to restrict network reachability to the ANSI SQLUTIL service: place it behind host-based or network firewalling so only trusted administrative subnets and management hosts can connect. The trade-off is that legitimate remote SQL administration must then be performed over an approved jump host or VPN, which adds operational friction but removes the unauthenticated remote attack path that the CVSS vector (AV:N/PR:N) depends on. Because the vector specifies PR:N and UI:N, credential hardening or user-training controls do not mitigate this issue - only network isolation or the vendor fix does. Where SQLUTIL is not needed on a given node, disabling or stopping the service removes the exposure entirely, at the cost of losing the associated ANSI SQL utility functionality; if the service must remain available, deploy monitoring or automatic restart supervision so that an unexpected termination is detected quickly and availability impact is bounded.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE NonStop ANSI SQLUTIL is a utility component within the NonStop SQL/MX platform on HPE NonStop systems, used for ANSI SQL operations and administration. The vulnerability class is CWE-248 (Uncaught Exception): an error condition raised while handling input or state in the service is not caught by the application's exception handling, causing the affected process to abort and the service to terminate unexpectedly. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the trigger is reachable over the network at low complexity without authentication and without user interaction, so the underlying attack surface is whatever network path exposes SQLUTIL to remote callers. The vector's C:N/I:N/A:H confirms this is a pure availability defect - no data disclosure or modification is expected - which aligns with the vendor-assigned 'Denial Of Service' tag. No CPE identifiers were included in the provided data, and the exact affected NonStop SQL/MX or NonStop OS version ranges must be confirmed from HPE bulletin hpesbns05148en_us; the internal coherence of the vector, CWE, and vendor tag leaves no network-versus-local contradiction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated request triggers an uncaught exception, so AV:N/PR:N/UI:N/AC:L; impact is crash-only, hence C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
Executive ViewAI
A remotely exploitable flaw in HPE NonStop's ANSI SQLUTIL service allows any unauthenticated network user to crash the service, disrupting availability of a platform that typically underpins high-value transaction processing and settlement workloads. Because no vendor patch is yet available and the attack requires no credentials, exposure is governed almost entirely by network reachability of the SQLUTIL service. Leadership should care because an outage on NonStop systems can stall revenue-generating and regulatory-critical batch and transactional processing, with recovery dependent on manual service restart.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict SQLUTIL service reachability to trusted administrative networks only using network ACLs, firewall segmentation, or host-based access controls; disable or stop the service where it is not operationally required; monitor for unexpected service termination and anomalous connection attempts to enable rapid restart; maintain current service-restart and failover runbooks; and track HPE advisory updates for a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB