CVE-2026-76659
7.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can crash the finger daemon to cause a denial of service. They only need network access to reach the service port.
Root cause
Missing authentication checks allow attackers to directly trigger a service crash in the finger daemon.
Affected systems
HPE NonStop TCP/IP UTILITIES (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Apply the vendor patch specified in HPE advisory hpesbns05148en_us, or disable the finger service and block TCP port 79 on NonStop systems as an immediate mitigation.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.