Read the docs
TI-2019-08997 Aliases CVE-2019-11993GHSA-8f22-pcx4-9xqm

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061675&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

Why it matters now

EPSS 0.0153 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; SimpliVity OmniStack for Lenovo; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; HPE SimpliVity 2600 Gen10releases from 3.0.8 to 3.7.9; releases from 3.6.2 to 3.7.9; releases from 3.7.1 to 3.7.9; releases from 3.7.8 to 3.7.9; releases from 3.7.5 to 3.7.9—No fix listedCNA
  • SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; SimpliVity OmniStack for Lenovo; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; HPE SimpliVity 2600 Gen10 Vendor— Affected releases from 3.0.8 to 3.7.9; releases from 3.6.2 to 3.7.9; releases from 3.7.1 to 3.7.9; releases from 3.7.8 to 3.7.9; releases from 3.7.5 to 3.7.9 Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:hp:simplivity_380_gen9_firmware:*:*:*:*:*:*:*:*3.6.2 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_380_gen9:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_380_gen10_g_firmware:*:*:*:*:*:*:*:*3.7.8 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_380_gen10_g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_380_gen10_firmware:*:*:*:*:*:*:*:*3.7.1 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_380_gen10:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_2600_gen10_firmware:*:*:*:*:*:*:*:*3.7.5 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_2600_gen10:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_omnicube_firmware:*:*:*:*:*:*:*:*3.0.8 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_omnicube:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hp:simplivity_omnistack_for_dell_firmware:*:*:*:*:*:*:*:*3.0.8 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_omnistack_for_dell:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_omnistack_for_cisco_firmware:*:*:*:*:*:*:*:*3.0.8 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_omnistack_for_cisco:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:simplivity_omnistack_for_lenovo_firmware:*:*:*:*:*:*:*:*3.0.8 – 3.7.9VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:simplivity_omnistack_for_lenovo:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
  • cpe:2.3:o:hp:simplivity_omnistack_for_dell_firmware:*:*:*:*:*:*:*:* Versions 3.0.8 – 3.7.9 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:h:hp:simplivity_omnistack_for_dell:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
  • cpe:2.3:o:hp:simplivity_omnistack_for_cisco_firmware:*:*:*:*:*:*:*:* Versions 3.0.8 – 3.7.9 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:h:hp:simplivity_omnistack_for_cisco:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
  • cpe:2.3:o:hp:simplivity_omnistack_for_lenovo_firmware:*:*:*:*:*:*:*:* Versions 3.0.8 – 3.7.9 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:h:hp:simplivity_omnistack_for_lenovo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11993
  2. 2026-10-03 Alias added: GHSA-8f22-pcx4-9xqm

References

Advisory 1

  • TI-2019-08998 Path traversal in HPE SimpliVity 2600 Gen10; HPE SimpliVity 380 Gen10; HPE SimpliVity 380… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences