A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.

published 2020-04-30 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28270

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 80.9%; EPSS 80.9% chance of exploitation in 30 days, percentile 99.6%
public exploits: 0; none known, plus a Nuclei check

A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).

Patch / fix

fixed in 1

hpe smart_update_manager 8.5.6

Exploit prediction

80.86% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access nuclei detection template

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Hewlett Packard Enterprise Smart Update Manager (SUM)

References

support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03997en_us
vendor-advisory

Sources

CVE List CVE-2020-7136
NVD CVE-2020-7136

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary