CVE-2026-79820: Vulnerability in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7

This vulnerability in HPE iLO 7 firmware version 1.25.00 involves a failure in remote user validation, enabling unauthenticated remote attackers to compromise the system. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and scope change, resulting in high confidentiality, integrity, and availability impacts. The vulnerability is publicly known but no exploits in the wild have been reported. No official patch or vendor advisory details are available at this time.

An unauthenticated remote attacker could exploit this validation failure to gain unauthorized access or control over the affected HPE iLO 7 device, potentially leading to full system compromise. The critical CVSS score reflects the severity of confidentiality, integrity, and availability impacts if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the iLO interface to trusted management networks only and monitor for unusual activity.