{"id":"CVE-2026-95779","published":"2026-11-09T14:17:25.010","lastModified":"2026-11-09T16:17:35.567","description":"An exposure of the appliance’s confidential certificate  information \nvulnerability exists in HPE Morpheus manager software.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The HPE Morpheus Manager software exposes confidential certificate information due to improper access controls, allowing authenticated users to access sensitive cryptographic material. This violates confidentiality and could enable further attacks like impersonation or decryption of intercepted traffic.","exploitability":"Exploitation requires low skill and only a valid low-privileged account, as the vulnerability stems from insufficient authorization checks on certificate data endpoints.","blast_radius":"If exploited, attackers could obtain private keys or certificates to impersonate the appliance, decrypt TLS traffic, or pivot into other systems trusting those credentials.","remediation":"Upgrade to HPE Morpheus Manager version 2.590 or later, which addresses this certificate exposure flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["credential-exposure","certificate-leak","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:47:47.803Z"}}