A potential security vulnerability has been identified in HPE Superdome Flex and…
Priority LOW 24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to allow disclosure of information. HPE has made the following software to resolve the vulnerability in HPE Superdome Flex Servers v3.65.8 and Superdome Flex 280 Servers v1.45.8.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix Fixed HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers (Hewlett Packard Enterprise (HPE)): Prior to Superdome Flex 3.65.8; Prior to Superdome Flex 280 1.45.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers | — | Prior to Superdome Flex 3.65.8; Prior to Superdome Flex 280 1.45.8 | Patch available | CNA |
- HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers VendorHewlett Packard Enterprise (HPE) Affected — Fixed in Prior to Superdome Flex 3.65.8; Prior to Superdome Flex 280 1.45.8 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hpe:superdome_flex_280_server_firmware:*:*:*:*:*:*:*:* | before 1.45.8 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:superdome_flex_280_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:* | before 3.65.8 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
- cpe:2.3:o:hpe:superdome_flex_280_server_firmware:*:*:*:*:*:*:*:* Versions before 1.45.8 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:superdome_flex_280_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:* Versions before 3.65.8 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
Remediation
- Fix · CNA HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers (Hewlett Packard Enterprise (HPE)) Fixed in Prior to Superdome Flex 3.65.8; Prior to Superdome Flex 280 1.45.8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-37939
- 2026-10-03 Alias added: GHSA-jc6j-h7h6-qc7h
References
More Hewlett Packard Enterprise (HPE) Superdome Flex 280 Server Firmware vulnerabilities
- TI-2022-07754 A potential security vulnerability has been identified in HPE Superdome Flex and… CVSS 3.1MEDIUM 6.7
Sources
- CVE-2022-37939 · CVE Program
- CVE-2022-37939 · NVD
- FIRST EPSS
- GHSA-jc6j-h7h6-qc7h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences