CVE-2026-76739: CWE-20 Improper input validation in Hewlett Packard Enterprise HPE Compute Scale-up Server 3200 platform

This vulnerability (CVE-2026-76739) affects HPE Compute Scale-up Server 3200 and 3250 platforms and the Superdome Flex server. It is caused by improper input validation (CWE-20) that could be remotely exploited by an attacker with low privileges to list and modify the RMC filesystem. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and low privileges required, with no user interaction needed. The impact is limited to low confidentiality impact, with no integrity or availability impact. No known exploits are reported in the wild. The affected versions are prior to 1.77.30, 1.03.38, and 4.17.03 respectively for the different platform components.

An attacker with low privileges can remotely list and modify the RMC filesystem on affected HPE server platforms. The confidentiality impact is low, and there is no impact on integrity or availability. This could potentially expose some information or allow limited unauthorized changes to the RMC filesystem, but does not lead to full system compromise based on available data.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the Hewlett Packard Enterprise advisory for current remediation guidance. Until a fix is available, restrict network access to the affected management interfaces and monitor for unusual activity related to RMC filesystem access.