CVE-2026-76740: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Hewlett Packard Enterprise HPE Compute Scale-up Server 3200 platform

This vulnerability (CVE-2026-76740) is classified as CWE-78, indicating improper neutralization of special elements used in OS commands, commonly known as OS command injection. It affects HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex, and Superdome Flex 280 servers. An attacker with high privileges can remotely execute arbitrary commands on the RMC, potentially compromising confidentiality, integrity, and availability of the affected systems. The CVSS v3.1 base score is 7.2, reflecting high impact with network attack vector, low attack complexity, high privileges required, no user interaction, and full confidentiality, integrity, and availability impact. The affected versions are software releases prior to 1.77.30, 1.03.38, 4.17.03, and 2.17.03 for different components. No vendor advisory or patch links were provided, so patch status is not confirmed.

Successful exploitation allows remote attackers with high privileges to execute arbitrary OS commands on the Remote Management Controller, leading to full compromise of confidentiality, integrity, and availability of the affected systems. This could enable attackers to control system functions, disrupt operations, or access sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the Remote Management Controller to trusted administrators only and monitor for suspicious activity. Avoid exposing management interfaces to untrusted networks.