CVE-2026-73789CWE-284broken-access-control

CVE-2026-73789

Medium · published September 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-09-10T00:20Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05130en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 19:15Z
    Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface
    cvelistv5