EUVD-2026-75977
GHSA-jw23-5jvx-42gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover IceWall endpoint over network
-
DeliveryCraft malformed/wrong-type protocol message
-
ExploitSend unauthenticated request to Federation Agent or Proxy
-
ExecutionTrigger CWE-241 improper type handling
-
PersistService crash or unresponsive state
-
ImpactSSO authentication disrupted for all relying applications
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Improper handling of unexpected data type
|
| Exploitation Conditions | No authentication is required and no special user interaction is needed - the CVSS vector (PR:N/UI:N/AV:N/AC:L) confirms this is exploitable by any remote unauthenticated party who can reach the IceWall Federation Agent or Proxy service over the network. The limiting factors are: (1) the service must be network-accessible to the attacker, so internet-exposed deployments are at higher risk than intranet-only ones; (2) the attacker must know or discover the endpoint; and (3) the affected software must be an unpatched version of HPE IceWall Federation Agent or Proxy - specific affected version ranges are defined in the vendor advisory, not the NVD CPE data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) represents a 7.5 high-severity unauthenticated network-reachable DoS with low attack complexity. This is consistent with the description: no authentication is required, no user interaction is needed, and the impact is purely on availability. Because IceWall sits in the authentication path for SSO-protected applications, a sustained DoS would block user authentication across all relying applications - making the effective business impact potentially higher than the CVSS availability score alone implies. No EPSS data was provided, no KEV listing exists, and no public exploit code is known, so real-world exploitation risk at scale appears low at time of analysis. The niche deployment footprint of IceWall (primarily Japanese enterprise environments) further limits broad exploitation probability, but any organization relying on IceWall for authentication infrastructure should treat this as operationally critical. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted network request - such as a malformed SAML assertion, federation protocol message, or HTTP request with an unexpected data type - to the IceWall Federation Agent or Proxy endpoint. The server fails to handle the incorrect data type, causing the service process to crash or become unresponsive. If the service lacks automatic restart capability, all SSO-protected applications behind IceWall become inaccessible until an administrator manually recovers the service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.
RemediationAI
The primary remediation is to consult and apply the patch described in HPE Security Bulletin HPESBMU05147 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbmu05147en_us&docLocale=en_US. No exact fixed version number is available in the provided data; administrators should refer directly to the bulletin for the specific patched release applicable to their IceWall version. As a compensating control pending patching, restrict network access to IceWall Federation Agent and Proxy endpoints to trusted IP ranges or internal networks only, which raises the bar from unauthenticated-internet to trusted-network exploitation. Note that restricting access may impact federated users who authenticate from external networks, so evaluate the operational trade-off carefully.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE IceWall is an enterprise single sign-on and identity federation platform, with the Federation Agent component acting as a SAML/web SSO relay and the Proxy component providing authentication proxying for protected web applications. CWE-241 (Improper Handling of Incorrect Data Type) indicates the vulnerable code path receives input of an unexpected or malformed type - such as a malformed protocol message, SAML assertion field, or HTTP header - and rather than safely rejecting it, reaches an unhandled state that causes a crash or resource exhaustion. The affected CPE (cpe:2.3:a:hewlett_packard_enterprise:hpe_icewall_products:*:*:*:*:*:*:*:*) covers the full IceWall product family without specifying a bounded version range, suggesting broad version exposure or that the advisory itself defines the scope.
Know when Hpe Icewall Products gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network DoS with no confidentiality or integrity impact; provided vendor vector is accurate and independently corroborated by description.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).
Executive ViewAI
HPE IceWall Federation Agent and Proxy can be remotely crashed by unauthenticated attackers, blocking access to all systems relying on federated identity authentication. A single malformed network request can disable the authentication proxy, preventing users from logging into federated applications and halting business operations. With no vendor patch available and no public exploit identified at time of analysis, the organization faces immediate risk of authentication outages until protective measures are deployed.
Pending vendor patch availability, implement network segmentation to restrict proxy access to authorized systems only, deploy rate limiting on the proxy service to absorb bulk denial-of-service traffic, configure network-based input validation rules to reject malformed requests before reaching the proxy, establish service health monitoring with automatic alerting on crashes, and design redundant authentication federation infrastructure with automatic failover capabilities to maintain business continuity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB