HPE NonStop SOAP 4.0: Memory corruption leading to system outage
Summary
HPE NonStop SOAP 4.0 contains a memory corruption flaw caused by improper input validation (CWE-20). Per the CVE record, an attacker reaching the SOAP service over the network may crash the system, which causes an outage. No confidentiality impact is listed, and the vector requires no privileges or user interaction. CISA SSVC data reports no known exploitation.
Affected
- HPE NonStop SOAP 4.0, product ID T0865, up to and including T0865L01^ACN
- Per the CVE record, the default configuration is affected.
Fixed in
- Fix: HPE SPR T0865L01^ACO for L24.08 onwards is listed in the HPE advisory snippet, but this needs verification on the advisory page.
- Exact availability date: Unknown.
- Some third-party sources state that no remediation is available yet; this may be outdated.
Workaround
- Vendor-specific workaround: Unknown.
- Restrict access to SOAP endpoints to trusted sources (generic hardening, not from HPE).
- Inspect SOAP traffic with a web application firewall (generic, not validated by HPE).
Exploitation
- No known exploitation in the wild.
- Not listed in the CISA KEV catalog; no public proof of concept found.
- Unconfirmed third-party speculation about possible code execution; not established.
Our recommendation
- Check whether NonStop SOAP 4.0 at T0865L01^ACN or earlier is in use.
- If affected, review HPE advisory HPESBNS05148, verify the SPR and its requirements, and apply it.
- Until patched, restrict SOAP access to trusted sources and monitor for unexpected restarts or core dumps.
- Relevance for typical Swiss SMEs is likely low, as NonStop is mainly used in large high-availability environments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNS05148 support.hpe.com
- OpenCVE CVE-2026-79821 app.opencve.io
- VulDB CVE-2026-79821 vuldb.com
- VulDB entry 420510 vuldb.com
- The Hacker Wire CVE-2026-79821 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:08.
Original description (NVD)
A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.