{"id":"CVE-2026-95779","kind":"vulnerability","aliases":["CVE-2026-95779"],"related":[],"title":"HPE Morpheus manager exposes appliance's confidential certificate information to attackers","description":"An exposure of the appliance’s confidential certificate  information \nvulnerability exists in HPE Morpheus manager software.","summary":"HPE Morpheus Manager software exposes confidential certificate information stored on the appliance. An attacker who reaches it can read that certificate material.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Morpheus Software","fixed":["9.0.2"],"affected":">= 9.0, < 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","hpe-morpheus","infrastructure","self-hosted"],"not_affected_if":[],"how_to_check":"Check your HPE Morpheus Software version (Morpheus UI footer/appliance version). Versions 9.0 up to but not including 9.0.2 are listed as affected. Confirm in HPE bulletin HPESBVS05168.","fix":"Per the CVE record, versions before 9.0.2 are affected, so move HPE Morpheus Software to 9.0.2 or later. Confirm against HPESBVS05168.","status":"open","published_at":"2026-11-09T14:17:25+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:39+00:00","updated_at":"2026-11-09T14:28:59+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-09T14:27:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HPE Morpheus manager exposes appliance's confidential certificate information to attackers","impact":"medium","summary":"HPE Morpheus Manager software exposes confidential certificate information stored on the appliance. An attacker who reaches it can read that certificate material.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-morpheus","appliance"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"certificate material readable by an attacker from the appliance","analyst_note":"Find the HPE advisory for CVE-2026-95779 to confirm affected Morpheus versions, fixed release and required access.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":4493,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE advisory for CVE-2026-95779 to confirm affected Morpheus versions, fixed release and required access.","search":"'-2026':13A,16A '-95779':14A,17A 'applianc':5A,21B,40B,55C 'attack':11A,42B 'certif':8A,35B,49B,58C 'confidenti':7A,34B,57C 'cve':12A,15A 'exist':61C 'expos':4A,33B 'exposur':52C 'host':28B 'hpe':1A,18A,23B,29B,63C 'hpe-morpheus':22B 'inform':9A,36B,59C 'infrastructur':25B 'manag':3A,31B,65C 'materi':50B 'morpheus':2A,19A,24B,30B,64C 'reach':44B 'read':47B 'self':27B 'self-host':26B 'softwar':32B,66C 'software':20A 'store':37B 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HPE Morpheus Software (Morpheus Manager) version 9.0 before 9.0.2. The CVSS vector (PR:L) suggests an authenticated low-privilege network user, but the bulletin text was not read, so confirm. Teams on 9.0.2 or later, or not running Morpheus, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hpemorpheussoftware","morpheussoftware"],"ptokens":["hpe","morpheus","software"],"labels":["appliance","high","hpemorpheus","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95779':14A,17A 'applianc':5A 'attack':11A 'certif':8A 'confidenti':7A 'cve':12A,15A 'expos':4A 'hpe':1A,18A 'inform':9A 'manag':3A 'morpheus':2A,19A 'software':20A","search_b":"'applianc':21B,40B 'attack':42B 'certif':35B,49B 'confidenti':34B 'expos':33B 'host':28B 'hpe':23B,29B 'hpe-morpheus':22B 'inform':36B 'infrastructur':25B 'manag':31B 'materi':50B 'morpheus':24B,30B 'reach':44B 'read':47B 'self':27B 'self-host':26B 'softwar':32B 'store':37B","search_c":"'applianc':55C 'certif':58C 'confidenti':57C 'exist':61C 'exposur':52C 'hpe':63C 'inform':59C 'manag':65C 'morpheus':64C 'softwar':66C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95779","severity":null,"published_at":"2026-11-09T14:17:25+00:00","modified_at":"2026-11-09T14:17:25+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95779:2295","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US","severity":null,"published_at":"2026-11-09T14:28:59+00:00","modified_at":"2026-11-09T14:28:59+00:00","first_seen_at":"2026-11-09T14:28:59+00:00","fetched_at":"2026-11-09T14:28:59+00:00","note":"HPE bulletin HPESBVS05168 (titled 'HPE VM Essentials Software, Multiple Vulnerabilities') is linked by the NVD record, but its body is JS-rendered and I could not read it (WebFetch empty, browser session died, web-cli search 402). Affected range 9.0 to <9.0.2 comes from the HPE-supplied CVE record via the NVD API, not from the bulletin text. Nothing marked verified. Not read: required access, workarounds, exact fixed release wording. X not checked.","cites":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US","https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95779"]}],"documents":[{"id":107853,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US","title":"HPESBVS05168 rev.1 - HPE VM Essentials Software, Multiple Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107852,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95779","title":"NVD record CVE-2026-95779 (HPE CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}