HyperCloud: "admin" and "serveradmin" users can be deleted
Priority LOW 20CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding. This issue affects HyperCloud versions 1.0 to any release before 2.1.
Why it matters now
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed HyperCloud (SoftIron): 2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA HyperCloud (SoftIron) Fixed in 2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45083
- 2026-10-03 Alias added: GHSA-37pw-72qc-wmmj
References
More SoftIron Hypercloud vulnerabilities
- TI-2023-24129 Media caddy removal and reinsertion without reboot may cause data loss CVSS 3.1HIGH 7.0
- TI-2023-24130 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" CVSS 3.1LOW 3.3
Sources
- CVE-2023-45083 · CVE Program
- CVE-2023-45083 · NVD
- FIRST EPSS
- GHSA-37pw-72qc-wmmj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences