HPE NonStop Middleware: Secret key handling and deserialization vulnerability
Summary
HPE NonStop Middleware contains a secret key handling flaw and a deserialization of untrusted data weakness (CWE-502). According to the CVSS vector, an attacker on the network could affect confidentiality, integrity and availability, but only with high attack complexity, high privileges and a changed scope. The vendor bulletin lists a fix, and no exploitation in the wild has been reported so far. NonStop is a niche high-availability platform, so the likelihood of exposure in Swiss SMEs is low.
Affected
- HPE NonStop Middleware T1155L01^AAF and earlier (per vendor bulletin HPESBNS05148)
Fixed in
- T1155L01^AAG for RVU L24.08 and later (per vendor fix table; exact SPR and RVU applicability to be confirmed in the full bulletin)
Workaround
Unknown. No vendor-published workaround found; the vendor recommends applying the fix.
Exploitation
- No evidence of exploitation in the wild found at last check; CISA KEV status not confirmed and should be re-checked.
- EPSS 0.00357 at time of retrieval (low).
- No public proof-of-concept found; search could not be fully completed.
- Technical details are limited.
Our recommendation
- Check whether any HPE NonStop systems exist in your environment; if none exist, no action is needed.
- If NonStop is in use, identify the installed NonStop Middleware version against T1155L01^AAF and plan the upgrade to T1155L01^AAG or later.
- Restrict administrative access to NonStop systems, since high privileges are required.
- Confirm the CVSS vector against the full vendor bulletin, as its header lists a local impact description.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNS05148 support.hpe.com
- Canadian Cyber Centre HPE advisory AV26-1046 www.cyber.gc.ca
- CVE-2026-73793 at threatint cve.threatint.com
- CVE-2026-73793 at CIRCL via Vulners (EPSS) vulners.com
- CVE-2026-73793 at Strix www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:35.
Original description (NVD)
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.