PT-2026-22593 · Hewlett Packard · Hpe Autopass License Server

Published 2026-03-02 · Updated 2026-03-08 · CVE-2026-23600

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions HPE AutoPass License Server (APLS) (affected versions not specified)

Description A remote authentication bypass issue exists in HPE AutoPass License Server. This allows unauthorized access. No information is available regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The issue allows bypassing authentication mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-23600

ZDI-26-134

Affected Products

Hpe Autopass License Server

References · 11

• https://zerodayinitiative.com/advisories/ZDI-26-134 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23600 · Security Note
• https://twitter.com/vuldb/status/2028505003804238013 · Twitter Post
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn05003en_us&docLocale=en_US · Note
• https://twitter.com/VulmonFeeds/status/2028535083582320770 · Twitter Post
• https://twitter.com/ThreatSynop/status/2029122882555519236 · Twitter Post
• https://twitter.com/ThreatSynop/status/2028992971996279265 · Twitter Post
• https://twitter.com/SystemTek_UK/status/2029654991074386046 · Twitter Post
• https://twitter.com/UndercodeNews/status/2030539838852669843 · Twitter Post
• https://twitter.com/threatcluster/status/2028840484957733040 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2028673919452909702 · Twitter Post