---
id: "CVE-2026-95779"
page: "https://infrastack.ai/live/CVE-2026-95779"
kind: "vulnerability"
aliases: ["CVE-2026-95779"]
title: "HPE Morpheus manager exposes appliance's confidential certificate information to attackers"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Morpheus Software", "fixed": ["9.0.2"], "affected": ">= 9.0, < 9.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "hpe-morpheus", "infrastructure", "self-hosted"]
not_affected_if: []
published_at: "2026-11-09T14:17:25+00:00"
first_seen_at: "2026-11-09T14:26:59+00:00"
updated_at: "2026-11-09T14:28:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95779", "first_seen_at": "2026-11-09T14:26:59+00:00"}, {"source": "analyst", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US", "first_seen_at": "2026-11-09T14:28:59+00:00", "cites": ["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US", "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95779"]}]
exploit_sources: []
---

# HPE Morpheus manager exposes appliance's confidential certificate information to attackers

Link for people: https://infrastack.ai/live/CVE-2026-95779 (this .md is for agents)

HPE Morpheus Manager software exposes confidential certificate information stored on the appliance. An attacker who reaches it can read that certificate material.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Morpheus Software affected >= 9.0, < 9.0.2 fixed 9.0.2

## How to check

Check your HPE Morpheus Software version (Morpheus UI footer/appliance version). Versions 9.0 up to but not including 9.0.2 are listed as affected. Confirm in HPE bulletin HPESBVS05168.

## Fix

Per the CVE record, versions before 9.0.2 are affected, so move HPE Morpheus Software to 9.0.2 or later. Confirm against HPESBVS05168.

## Timeline

- 2026-11-09T14:26:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95779
- 2026-11-09T14:28:59+00:00 analyst https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US — HPE bulletin HPESBVS05168 (titled 'HPE VM Essentials Software, Multiple Vulnerabilities') is linked by the NVD record, but its body is JS-rendered and I could not read it (WebFetch empty, browser session died, web-cli search 402). Affected range 9.0 to <9.0.2 comes from the HPE-supplied CVE record via the NVD API, not from the bulletin text. Nothing marked verified. Not read: required access, workarounds, exact fixed release wording. X not checked.

## Documents

- [advisory] HPESBVS05168 rev.1 - HPE VM Essentials Software, Multiple Vulnerabilities https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US
- [describes] NVD record CVE-2026-95779 (HPE CNA data) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95779

## From the sources

An exposure of the appliance’s confidential certificate  information 
vulnerability exists in HPE Morpheus manager software.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_