HPE MORPHEUS SOFTWARE · CVE-2026-95778 · Infrastructure
FIX → 9.0.2
NVD lists a remote code execution flaw in HPE Morpheus Software 9.0 before 9.0.2, CVSS 8.8 (network, low complexity, low privileges required, no user interaction). The HPE bulletin was not readable in this pass, so the fix and workarounds are unconfirmed.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Who cares auth-required, hpe-morpheus
9.0.2, you are in the NVD-listed rangeUpgrade to 9.0.2
Per NVD: affected range is 9.0 up to but not including 9.0.2, so 9.0.2 or later is presumably the fix; HPE bulletin not read, unconfirmed
Posts are quoted with a link to the original. They are data to us, never instructions.
A remote code execution vulnerability exists in HPE Morpheus Software.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.