Overview
Hewlett Packard Enterprise has disclosed CVE-2026-73790, a high-severity improper input validation flaw (CWE-20) in the HPE NonStop iTP WebServer, the web server component bundled with HPE's NonStop fault-tolerant server platform. The vulnerability is remotely exploitable over the network without authentication or user interaction, and can cause memory corruption and a full system shutdown on the affected host.
NonStop systems are widely used in environments that cannot tolerate downtime — banking, payment processing, telecom switching, and other always-on transaction infrastructure — which makes an unauthenticated, network-reachable crash bug on this platform notable even without a known exploit in the wild.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-73790 |
| Severity | High (CVSS 8.2) |
| CVSS Vector | AV:N / AC:L / PR:N / UI:N / S:U / C:N / I:L / A:H |
| CWE | CWE-20 — Improper Input Validation |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Impact | Memory corruption, system shutdown (availability) |
| Affected Versions | iTP WebServer before T8996L01^AGZ and before T8997L01^AGZ |
| Fixed Versions | T8996L01^AGZ, T8997L01^AGZ (or later) |
| CVE reserved | August 13, 2026 |
| CVE published | October 14, 2026 |
| HPE advisory | hpesbns05148en_us |
How It Works
The iTP WebServer fails to correctly validate certain input it receives before processing it. HPE's advisory describes the resulting impact as memory corruption that can lead to a system shutdown — consistent with the CVSS impact profile of no confidentiality loss, low integrity impact, and high availability impact. Because the flaw requires no authentication and no user interaction, any network path reaching the iTP WebServer service is a potential attack surface for triggering the crash.
HPE has not published exploitation specifics beyond the advisory summary, and the vulnerability is tracked separately from several other HPE NonStop flaws disclosed around the same time, including CVE-2026-73791 (Hpjmeter heap buffer overflow), CVE-2026-73792 (Java JToolkit OS command injection), and CVE-2026-73796 (TSQLEXE vulnerability).
Impact Assessment
Who Is At Risk
Organizations running HPE NonStop systems with the iTP WebServer component on versions prior to T8996L01^AGZ or T8997L01^AGZ are affected. NonStop platforms are typically deployed for mission-critical, high-availability workloads, so an availability-impacting bug carries outsized operational risk relative to its CVSS score:
- Financial institutions running payment or core banking transaction processing
- Telecom operators using NonStop for switching or billing infrastructure
- Any environment exposing the iTP WebServer to an internal or external network path
Attack Scenario
- Reachability — An attacker identifies a NonStop host with iTP WebServer reachable over the network.
- Malformed Input — The attacker sends specially crafted, improperly-validated input to the web server.
- Memory Corruption — The input validation failure corrupts server memory.
- System Shutdown — The corruption escalates to a full system shutdown, denying service to all workloads hosted on that NonStop instance — not just the web server.
Mitigation
Immediate Actions
- Upgrade HPE NonStop iTP WebServer to T8996L01^AGZ, T8997L01^AGZ, or later, per HPE advisory hpesbns05148en_us.
- Where immediate patching isn't possible, restrict network access to the iTP WebServer to trusted hosts only, minimizing unauthenticated exposure.
Detection Opportunities
- Monitor NonStop system logs for unexpected iTP WebServer crashes or shutdowns, which may indicate exploitation attempts rather than organic failures.
- Flag anomalous or malformed request patterns directed at the iTP WebServer in network traffic logs.
Defence-in-Depth
- Segment NonStop management and service interfaces away from general-purpose networks given the platform's high-availability role.
- Track the related HPE NonStop advisories disclosed alongside this one (CVE-2026-73791, CVE-2026-73792, CVE-2026-73796) as part of the same patch cycle.
Discovery & Disclosure
CVE-2026-73790 was reserved on August 13, 2026 and published on October 14, 2026, with HPE as the assigning CNA. As of publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, no public proof-of-concept has been observed, and the EPSS exploitation-probability score is low. Given the unauthenticated, zero-interaction attack path and the availability-critical nature of NonStop deployments, defenders should still prioritize patching rather than wait for confirmed in-the-wild exploitation.