{"id":"CVE-2026-44875","kind":"vulnerability","aliases":["CVE-2026-44875"],"related":[],"title":"HPE Cray Programming Environment: local user can gain elevated access","description":"In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.","summary":"HPE Cray Programming Environment versions 25.03 and 25.09, before 26.03, deploy in a way that can let a local unprivileged user gain elevated access. An attacker with a local account on an affected system could gain higher privileges.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","hpcm","hpe-cray","infrastructure"],"not_affected_if":["version-26.03-or-later"],"how_to_check":"- Check the installed Cray Programming Environment version against the affected range (25.03 and 25.09).","fix":"- Move to a Cray Programming Environment release at or after `26.03`.","status":"open","published_at":"2026-11-05T20:17:58+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:43:36+00:00","updated_at":"2026-11-05T20:43:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T20:43:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Cray Programming Environment release at or after `26.03`.","reach":"local","title":"HPE Cray Programming Environment: local user can gain elevated access","impact":"high","summary":"HPE Cray Programming Environment versions 25.03 and 25.09, before 26.03, deploy in a way that can let a local unprivileged user gain elevated access. An attacker with a local account on an affected system could gain higher privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-cray","hpcm","hpc"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local unprivileged user gains elevated access on the system","analyst_note":"Check the NVD entry and HPE advisory for the exact deployment method and any workaround before 26.03.","how_to_check":"- Check the installed Cray Programming Environment version against the affected range (25.03 and 25.09).\n- unknown for other checks; the sources do not say how the deployment method is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["version-26.03-or-later"],"who_is_affected":"Sites running HPE Cray Programming Environment 25.03 or 25.09 deployed on HPCM, where local users share the system. The sources do not describe further conditions. Systems on 26.03 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4194,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-44875':13A,16A '25.03':28B,67C '25.09':30B,69C '26.03':32B,72C 'access':10A,46B,84C 'account':52B 'affect':55B 'allow':82C 'attack':48B 'could':57B 'cpe':76C 'cray':2A,21B,24B,63C 'cve':11A,14A 'deploy':33B,78C 'elev':9A,45B,83C 'environ':4A,26B,65C 'gain':8A,44B,58B 'higher':59B 'hpc':17B 'hpcm':18B,80C 'hpe':1A,20B,23B,62C 'hpe-cray':19B 'infrastructur':22B 'let':39B 'local':5A,41B,51B,87C 'method':74C 'potenti':81C 'prior':70C 'privileg':60B 'program':3A,25B,64C 'system':56B 'unprivileg':42B,88C 'user':6A,43B,89C 'version':27B,66C 'way':36B","nicknames":[],"mitigations":[],"who_affected":"Sites running HPE Cray Programming Environment 25.03 or 25.09 deployed on HPCM, where local users share the system. The sources do not describe further conditions. Systems on 26.03 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hpc","hpcm","hpecray","infrastructure"],"campaign_type":null,"first_public_at":"2026-11-05T20:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44875","severity":null,"published_at":"2026-11-05T20:17:58+00:00","modified_at":"2026-11-05T20:17:58+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}