HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands.

published 2020-01-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-3654

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could allow an Administrator to bypass security restrictions and access multiple remote vulnerabilities including information disclosure, or denial of service. HPE has provided firmware updates that address the above vulnerabilities for the HPE Superdome Flex Server starting with firmware version v3.20.186 (not available online) and v3.20.206 (available online). Apply v3.20.206 (4 December 2019) or a newer version to resolve this issue. Please visit HPE Support Center https://support.hpe.com/hpesc/public/home to obtain the updated firmware for your product.

Patch / fix

fixed in 1

hpe superdome_flex_server_firmware 3.20.186

Exploit prediction

0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

HPE HPE Superdome Flex Server

Classification

Weakness

CWE-20 Improper Input Validation

References

support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03978en_us
vendor-advisory

Sources

CVE List CVE-2019-11998
NVD CVE-2019-11998

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary