A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers.

published 2022-04-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28641

cvss: 6.7; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. The vulnerability could be locally exploited to allow an user with Administrator access to escalate their privilege. The vulnerability is resolved in the latest firmware update. HPE Superdome Flex Server Version 3.50.58 or later, HPE Superdome Flex 280 Server Version 1.20.204 or later.

Patch / fix

fixed in 2

hpe superdome_flex_server_firmware 3.50.58
hpe superdome_flex_280_server_firmware 1.20.204

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a HPE Superdome Flex Server; HPE Superdome Flex 280 Server

References

support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04266en_us
vendor-advisory

Sources

CVE List CVE-2022-23702
NVD CVE-2022-23702

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary