CVE-2026-73787CWE-78command-injection

CVE-2026-73787

High · published September 10, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
57.5
In the wild
Unconfirmed
What it is

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00841 · 57.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-10T00:20Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05130en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 1%
    epss
  • 09 SEP 19:14Z
    Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface
    cvelistv5