---
id: "CVE-2026-95778"
page: "https://infrastack.ai/live/CVE-2026-95778"
kind: "vulnerability"
aliases: ["CVE-2026-95778"]
title: "HPE Morpheus: remote code execution flaw lets an attacker run commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Morpheus Software", "fixed": ["9.0.2"], "affected": ">= 9.0, < 9.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "hpe-morpheus", "infrastructure"]
not_affected_if: []
published_at: "2026-11-09T14:17:24+00:00"
first_seen_at: "2026-11-09T14:26:59+00:00"
updated_at: "2026-11-09T14:29:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95778", "first_seen_at": "2026-11-09T14:26:59+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95778", "first_seen_at": "2026-11-09T14:29:11+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-95778"]}]
exploit_sources: []
---

# HPE Morpheus: remote code execution flaw lets an attacker run commands

Link for people: https://infrastack.ai/live/CVE-2026-95778 (this .md is for agents)

NVD lists a remote code execution flaw in HPE Morpheus Software 9.0 before 9.0.2, CVSS 8.8 (network, low complexity, low privileges required, no user interaction). The HPE bulletin was not readable in this pass, so the fix and workarounds are unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Morpheus Software affected >= 9.0, < 9.0.2 fixed 9.0.2

## How to check

Check your HPE Morpheus Software version (in the UI or your install); if it is 9.0.x below 9.0.2, you are in the NVD-listed range. Confirm against HPE bulletin HPESBVS05168.

## Fix

Per NVD: affected range is 9.0 up to but not including 9.0.2, so 9.0.2 or later is presumably the fix; HPE bulletin not read, unconfirmed

## Timeline

- 2026-11-09T14:26:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95778
- 2026-11-09T14:29:11+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-95778 — NVD API record only (web-cli out of Exa credits; HPE bulletin hpesbvs05168en_us is JS-rendered, WebFetch got headings only, browser sessions died; page title reads 'HPE VM Essentials Software, Multiple Vulnerabilities'). Nothing verified. Needs a read of the HPE bulletin to confirm versions, fix, privileges, workarounds.

## Documents

- [describes] NVD CVE-2026-95778 (API record: HPE Morpheus Software 9.0 before 9.0.2, CVSS 8.8) https://nvd.nist.gov/vuln/detail/CVE-2026-95778

## From the sources

A remote code execution vulnerability exists in HPE Morpheus Software.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_