Loading story…
Hewlett Packard Enterprise disclosed CVE-2026-23594, a high-severity remote privilege-escalation vulnerability in certain configurations of HPE Alletra 6000, HPE Alletra 5000, and HPE Nimble Storage arrays running vulnerable Array OS firmware. The issue is network-exploitable and can allow an attacker with low privileges to elevate to administrative access, enabling full compromise of the storage system with high impact to confidentiality, integrity, and availability (CVSS v3.1 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
HPE’s bulletin (HPESBST04995) advises organizations to prioritize remediation for exposed or broadly reachable storage management networks, given the potential for data access, disruption, or use of storage/backup infrastructure as a staging point for ransomware. Affected versions include Array OS releases prior to 6.1.2.800 and 6.1.3 prior to 6.1.3.300 across Alletra and Nimble product lines; HPE has released fixes and recommends upgrading to patched versions (including 6.1.2.800 and 6.1.3.300, as applicable) to mitigate the risk.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
HPE issued security bulletin HPESBST04995 warning that CVE-2026-23594 could allow remote privilege escalation to administrative access on affected storage arrays in certain configurations. The company said successful exploitation could lead to full system compromise, including data exfiltration, operational disruption, or ransomware deployment.
HPE released patches for the high-severity privilege escalation flaw CVE-2026-23594 affecting Alletra 5000, Alletra 6000, and Nimble Storage arrays. Customers were advised to upgrade to Array OS 6.1.2.800 or 6.1.3.300 to remediate the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett Packard Enterprise released **ALE 5.1.0.0** to fix ten vulnerabilities in HPE Networking Analytics and Location Engine (ALE) 5.0.0.0 and earlier. The most severe, `CVE-2026-76708` (hard-coded default credentials) and `CVE-2026-76709` (privileged arbitrary file write), are remotely exploitable without authentication, carry CVSS 9.8 scores, and could enable full appliance compromise. The ALE advisory also addresses information disclosure, data injection, root-level filesystem and command-execution exposure, man-in-the-middle risk, denial of service, and password-hash disclosure. HPE reported no known public exploit code or active exploitation, but administrators should upgrade immediately and restrict or segment access to ALE management interfaces; a related HPE advisory also identifies a remote denial-of-service vulnerability in Telco Service Orchestrator 5.6.0 and earlier.
Sep 25, 2026
Hewlett Packard Enterprise issued security bulletins for multiple vulnerabilities affecting HPE Networking Instant On access points, HPE Telco Service Orchestrator, HPE Unified OSS Console, Compute Scale-up Server 3200 and 3250 platforms, and HPE Superdome Flex systems. The disclosures include unspecified flaws as well as vulnerabilities enabling remote RMC file modification and remote command execution on specified enterprise-server platforms. Administrators should identify affected HPE assets, review the applicable product security bulletins, and upgrade to the listed fixed versions or later where available. Organizations should prioritize remediation of internet-accessible and operationally critical server-management systems, given the potential impact of remote command execution and unauthorized file modification.
Oct 1, 2026
Hitachi published security advisories for **Hitachi Disk Array Systems** covering two vulnerabilities tracked as `CVE-2025-1978` and `CVE-2025-2902`. The notices were issued through Hitachi's Storage Solutions security advisory channel and identify the affected product family as enterprise disk array systems. The advisories provide vulnerability notifications for storage administrators and security teams monitoring Hitachi infrastructure. While the referenced notices do not include public synopsis details, the disclosures indicate that organizations using Hitachi Disk Array Systems should review the vendor guidance for affected models, exposure, and any recommended remediation or mitigation steps tied to `CVE-2025-1978` and `CVE-2025-2902`.
Jun 29, 2026