CVE-2026-76740
7.2HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Authenticated attackers with high privileges can execute arbitrary commands remotely on the Rack Management Controller (RMC). They need valid high-privilege credentials and network access to the management interface.
Root cause
Improper neutralization of special elements in OS commands (OS command injection) in the RMC firmware.
Affected systems
HPE Compute Scale-up Server 3200, 3250, Superdome Flex, and Superdome Flex 280 (exact firmware versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Check HPE advisory hpesbhf05153en_us for target firmware versions to install, and isolate the RMC network interface to trusted administrative traffic in the interim.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.