{"id":"CVE-2026-95778","kind":"vulnerability","aliases":["CVE-2026-95778"],"related":[],"title":"HPE Morpheus: remote code execution flaw lets an attacker run commands","description":"A remote code execution vulnerability exists in HPE Morpheus Software.","summary":"NVD lists a remote code execution flaw in HPE Morpheus Software 9.0 before 9.0.2, CVSS 8.8 (network, low complexity, low privileges required, no user interaction). The HPE bulletin was not readable in this pass, so the fix and workarounds are unconfirmed.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Morpheus Software","fixed":["9.0.2"],"affected":">= 9.0, < 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","hpe-morpheus","infrastructure"],"not_affected_if":[],"how_to_check":"Check your HPE Morpheus Software version (in the UI or your install); if it is 9.0.x below 9.0.2, you are in the NVD-listed range. Confirm against HPE bulletin HPESBVS05168.","fix":"Per NVD: affected range is 9.0 up to but not including 9.0.2, so 9.0.2 or later is presumably the fix; HPE bulletin not read, unconfirmed","status":"open","published_at":"2026-11-09T14:17:24+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:38+00:00","updated_at":"2026-11-09T14:29:11+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T14:27:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HPE Morpheus: remote code execution flaw lets an attacker run commands","impact":"high","summary":"HPE Morpheus Software contains a flaw that allows remote code execution, per the NVD entry. An attacker who can reach the software could run code on the host it runs on.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-morpheus"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs on the Morpheus host","analyst_note":"Check the HPE security bulletin and the NVD entry for affected versions, fixed releases, and required privileges or network position.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000616,"input_tokens":4464,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the HPE security bulletin and the NVD entry for affected versions, fixed releases, and required privileges or network position.","search":"'-2026':13A,16A '-95778':14A,17A '8.8':43B '9.0':39B '9.0.2':41B 'attack':9A 'auth':22B 'auth-requir':21B 'bulletin':55B 'code':4A,32B,71C 'command':11A 'complex':46B 'cve':12A,15A 'cvss':42B 'execut':5A,33B,72C 'exist':74C 'fix':64B 'flaw':6A,34B 'hpe':1A,18A,25B,36B,54B,76C 'hpe-morpheus':24B 'infrastructur':27B 'interact':52B 'let':7A 'list':29B 'low':45B,47B 'morpheus':2A,19A,26B,37B,77C 'network':44B 'nvd':28B 'pass':61B 'privileg':48B 'readabl':58B 'remot':3A,31B,70C 'requir':23B,49B 'run':10A 'softwar':38B,78C 'software':20A 'unconfirm':68B 'user':51B 'vulner':73C 'workaround':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hpemorpheussoftware","morpheussoftware"],"ptokens":["hpe","morpheus","software"],"labels":["authrequired","high","hpemorpheus","infrastructure"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95778':14A,17A 'attack':9A 'code':4A 'command':11A 'cve':12A,15A 'execut':5A 'flaw':6A 'hpe':1A,18A 'let':7A 'morpheus':2A,19A 'remot':3A 'run':10A 'software':20A","search_b":"'8.8':43B '9.0':39B '9.0.2':41B 'auth':22B 'auth-requir':21B 'bulletin':55B 'code':32B 'complex':46B 'cvss':42B 'execut':33B 'fix':64B 'flaw':34B 'hpe':25B,36B,54B 'hpe-morpheus':24B 'infrastructur':27B 'interact':52B 'list':29B 'low':45B,47B 'morpheus':26B,37B 'network':44B 'nvd':28B 'pass':61B 'privileg':48B 'readabl':58B 'remot':31B 'requir':23B,49B 'softwar':38B 'unconfirm':68B 'user':51B 'workaround':66B","search_c":"'code':71C 'execut':72C 'exist':74C 'hpe':76C 'morpheus':77C 'remot':70C 'softwar':78C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95778","severity":null,"published_at":"2026-11-09T14:17:24+00:00","modified_at":"2026-11-09T14:17:24+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95778:2296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95778","severity":null,"published_at":"2026-11-09T14:29:11+00:00","modified_at":"2026-11-09T14:29:11+00:00","first_seen_at":"2026-11-09T14:29:11+00:00","fetched_at":"2026-11-09T14:29:11+00:00","note":"NVD API record only (web-cli out of Exa credits; HPE bulletin hpesbvs05168en_us is JS-rendered, WebFetch got headings only, browser sessions died; page title reads 'HPE VM Essentials Software, Multiple Vulnerabilities'). Nothing verified. Needs a read of the HPE bulletin to confirm versions, fix, privileges, workarounds.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95778"]}],"documents":[{"id":107854,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95778","title":"NVD CVE-2026-95778 (API record: HPE Morpheus Software 9.0 before 9.0.2, CVSS 8.8)","kind":"other","source":"analyst","publisher":null,"text":"A remote code execution vulnerability exists in HPE Morpheus Software. Affected: from 9.0 before 9.0.2. CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N. Reference: HPE bulletin hpesbvs05168en_us. Status: received, not analyzed. Published 2026-11-09.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}