HPE MORPHEUS SOFTWARE · CVE-2026-95779 · Infrastructure
FIX → 9.0.2
HPE Morpheus Manager software exposes confidential certificate information stored on the appliance. An attacker who reaches it can read that certificate material.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run HPE Morpheus Software (Morpheus Manager) version 9.0 before 9.0.2. The CVSS vector (PR:L) suggests an authenticated low-privilege network user, but the bulletin text was not read, so confirm. Teams on 9.0.2 or later, or not running Morpheus, can skip it.
Who cares appliance, hpe-morpheus, self-hosted
9.0.2 are listed as affectedUpgrade to 9.0.2
9.0.2 are affected, so move HPE Morpheus Software to 9.0.2 or laterPosts are quoted with a link to the original. They are data to us, never instructions.
An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.