HPE vulnerabilities1 known to be exploited.
HPE has 158 published vulnerabilities across 567 products in our catalogue. 1 of them is on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Proliant Dl380 Gen10 Server, with 21. If you run HPE software, patch the exploited flaws first.
The most recent HPE flaw added to the known-exploited list is CVE-2017-5689, on 28 January 2022. We keep watching the known-exploited list.
Which HPE products have the most vulnerabilities?
Proliant Dl380 Gen10 Server leads with 21 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
- Proliant Dl380 Gen10 Server
- Proliant Dl180 Gen10 Server
- Proliant Ml110 Gen10 Server
- Proliant E910 Server Blade
- Proliant Dl560 Gen10 Server
- Proliant Xl230k Gen10 Server
- Proliant Xl270d Gen10 Server
- Proliant Ml350 Gen10 Server
- Proliant Bl460c Gen10 Server Blade
- Proliant Dl160 Gen10 Server
Which HPE vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Which HPE flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 92%
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).
- 84%CVE-2024-53675High
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
- 80%CVE-2020-7136Critical
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.
- 56%CVE-2024-53676Critical
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
- 53%CVE-2016-7434High
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
- 47%CVE-2024-53674High
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
- 25%CVE-2002-20001High
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation...
- 12%CVE-2016-7426High
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the...
- 9.4%CVE-2019-7317Medium
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
- 9.0%CVE-2018-7185High
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other...
All HPE products we track.
176 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Integrated Lights-Out 5 Firmwareintegrated_lights-out_5_firmware17 vulnerabilities3 versions
- Cloudline Cl3100 Gen10 Server Firmwarecloudline_cl3100_gen10_server_firmware16 vulnerabilities2 versions
- Cloudline Cl4100 Gen10 Server Firmwarecloudline_cl4100_gen10_server_firmware16 vulnerabilities2 versions
- Cloudline Cl5200 Gen9 Server Firmwarecloudline_cl5200_gen9_server_firmware16 vulnerabilities1 version
- Cloudline Cl5800 Gen10 Server Firmwarecloudline_cl5800_gen10_server_firmware16 vulnerabilities1 version
- Cloudline Cl5800 Gen9 Server Firmwarecloudline_cl5800_gen9_server_firmware16 vulnerabilities1 version
- Baseboard Management Controllerbaseboard_management_controller14 vulnerabilities1 version
- Arubaos-Cxarubaos-cx7 vulnerabilities29 versions
- Hpux-NTPhpux-ntp7 vulnerabilities6 versions
- Insight Remote Supportinsight_remote_support6 vulnerabilities7 versions
- Nimbleosnimbleos6 vulnerabilities62 versions
- Oneview Global Dashboardoneview_global_dashboard6 vulnerabilities3 versions
- Superdome Flex Server Firmwaresuperdome_flex_server_firmware5 vulnerabilities6 versions
- Smart Update Managersmart_update_manager4 vulnerabilities26 versions
- Arubaos-Switcharubaos-switch3 vulnerabilities70 versions
- Hf20 Firmwarehf20_firmware3 vulnerabilities2 versions
- Hf20c Firmwarehf20c_firmware3 vulnerabilities2 versions
- Hf20h Firmwarehf20h_firmware3 vulnerabilities2 versions
- Hf40 Firmwarehf40_firmware3 vulnerabilities2 versions
- Hf40c Firmwarehf40c_firmware3 vulnerabilities2 versions
- Hf60 Firmwarehf60_firmware3 vulnerabilities2 versions
- Hf60c Firmwarehf60c_firmware3 vulnerabilities2 versions
- Serviceguard for Linuxserviceguard_for_linux3 vulnerabilities1 version
- Sf100 Firmwaresf100_firmware3 vulnerabilities2 versions
This directory lists the 176 HPE products with at least one tracked version, of 567 in our catalogue.
Running HPE? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
- Matched to
- HPE on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 158 published vulnerabilities across 567 products and 609 versions from HPE. The most recent HPE flaw added to the known-exploited list is CVE-2017-5689, on 28 January 2022.
1 HPE vulnerability is on the list of flaws known to be exploited. The most recently added is CVE-2017-5689. The full list is on this page.
Proliant Dl380 Gen10 Server, with 21 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the HPE products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.