HPE iLO 7: Remote user validation failure in management firmware
Summary
HPE Integrated Lights-Out (iLO) 7 firmware contains a remote user validation failure. According to HPE, an unauthenticated remote attacker could obtain administrative access to the iLO management controller, which sits below the operating system of the server. The CVSS base score is 9.0 (critical), but the issue is rated as high complexity and HPE links it to iLO 7 used with HPE Compute Ops Management (COM).
Affected
- HPE Integrated Lights-Out (iLO) 7 firmware 1.25.00
- Scope: iLO 7 on HPE Gen12 platforms, such as ProLiant DL340 Gen12
- Unknown: whether earlier iLO 7 builds are affected. HPE lists only 1.25.00, so earlier builds are presumably not affected, but this is not confirmed.
Fixed in
- Upgrade to iLO 7 firmware 1.25.01 or later, available from the HPE Support Center.
Workaround
- No workaround is documented in the sources reviewed. HPE's resolution names only the firmware update.
- Interim step (recommendation, not from a vendor source): restrict iLO management interfaces to a dedicated management VLAN and block any internet exposure until 1.25.01 is applied.
Exploitation
- HPE reports no confirmed exploitation and no public proof of concept.
- The Italian CSIRT (ACN) alert records no PoC and no known exploitation.
- Not listed in CISA KEV in the sources checked. CISA SSVC assessment: exploitation none, not automatable.
- Recheck before acting, as the sources may change.
Our recommendation
- Identify Gen12 ProLiant servers with iLO 7 firmware, especially those managed through COM.
- Apply iLO 7 firmware 1.25.01 or later in the current maintenance window.
- Ensure iLO interfaces are not reachable from the internet or user networks; keep them on a dedicated management VLAN.
- Monitor iLO login and access logs for unexpected administrative sessions until patching is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin hpesbhf05163en_us support.hpe.com
- ACN (Italian CSIRT) alert on HPE iLO 7 www.acn.gov.it
- Torck: HPE iLO vulnerabilities www.torck.io
- Security Online: HPE iLO 7 vulnerability analysis securityonline.info
- TheHackerWire: CVE-2026-79820 www.thehackerwire.com
- DEV Community: CVE-2026-79820 analysis dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:15.
Original description (NVD)
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.