HPE Superdome Flex EUVD-2026-104091

Exploitation targets the Remote Management Controller (RMC) interface of the affected HPE scale-up servers and requires network reachability to that management interface. The CVSS vector's PR:H means the attacker must authenticate with HIGH privileges on the RMC before injecting commands - this is the primary limiting factor and rules out unauthenticated exploitation. No user interaction is required (UI:N) and attack complexity is low (AC:L) once privileged access is held. Risk is further bounded by whether the RMC management network is segmented/isolated from general networks per HPE best practice; exposure of the RMC to untrusted networks significantly raises real-world risk. The exact RMC feature/parameter that accepts the injected command is not specified in the available data.

This is a CWE-78 OS command injection flaw on the Remote Management Controller (RMC) of HPE's high-end Compute Scale-up 3200/3250 and Superdome Flex / Flex 280 platforms, rated CVSS 7.2 (High). The vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N shows network reachability with low attack complexity but HIGH privileges required (PR:H), so this is NOT an unauthenticated remote takeover - an attacker must already hold a privileged RMC account. Full C:H/I:H/A:H with unchanged scope (S:U) means complete compromise of the management controller itself once authenticated. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or widespread automated attacks. The practical priority is moderate: although arbitrary command execution on a management controller is serious, the PR:H requirement and the niche, limited deployment footprint of these specialized servers substantially narrow the realistic attacker population. Treat as a privilege-escalation / post-authentication hardening fix on the management plane rather than a mass-exploitation emergency; prioritize patching where RMC interfaces are network-exposed.

An attacker who has obtained valid privileged (PR:H) credentials to the RMC management interface - for example a malicious insider, or an outsider who harvested or reused administrative credentials - sends a crafted request whose parameter is passed unsanitized into an OS command. This injects and executes arbitrary commands on the RMC, yielding full control of the server's management controller. No public exploit code is identified at time of analysis, and no user interaction is required.