HPE NonStop KMS EUVD-2026-102019

Exploitation requires a crafted/malformed input message delivered to the HPE Nonstop KMS (Key Management Services) Server process. Per the CVSS vector, the attacker needs local access (AV:L) to the Nonstop system, must already hold low-level privileges (PR:L, i.e. an authenticated account), and a user/operator interaction is required to process the malicious message (UI:R). These factors - local-only reach, pre-existing authentication, and required interaction - substantially limit realistic exploitation, and the impact is confined to availability (A:L) of the KMS Server with no confidentiality or integrity effect.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) scores only 2.8 because exploitation requires local access, existing low privileges (PR:L, i.e. authenticated), and user interaction (UI:R), while the only impact is a low-level hit to availability (A:L) with no confidentiality or integrity consequences - consistent with a buffer overflow that most likely crashes or degrades the KMS Server process rather than enabling code execution. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code (POC) was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals (the low CVSS aligns with the limited, local, interaction-dependent nature of the flaw), though the absence of an EPSS value means probabilistic exploitation likelihood could not be independently weighed. Bottom line: a low-CVSS, low-real-risk defect affecting a niche platform - remediate on a normal patch cycle, not as an emergency.

An attacker who already has a low-privileged local account on an HPE Nonstop system crafts a malformed input message and delivers it to the KMS Server in a way that requires an operator or user action to process, triggering a buffer overflow. The result is a crash or disruption of the key management service (availability impact only). No public exploit code is known, so this would currently require custom development.