HPE (Organization): news timeline & CVEs

Security researcher claims to they found KVM guest-host escape flaw

Researcher claims a KVM guest-to-host escape zero-day; Vercel confirmed it, but no details are public.

Security researcher Paulos Yibelo says he won a Vercel bug bounty for a full guest-to-host root escape in industry-standard hypervisors. Vercel CEO Guillermo Rauch said the company confirmed a Linux KVM zero-day affecting Vercel Sandbox, which uses AWS Firecracker MicroVMs on KVM. No CVE, exploit details, or patch have been published, and The Register found no related mailing-list discussion. KVM is widely used by AWS, Google, Nutanix, HPE, and Proxmox; the article also recalls the earlier Januscape KVM bug.

The Register · SecurityOct 6, 02:06 UTC · 3d agoVulnerability 3 sources

Security researcher claims they found KVM guest-host escape flaw

Paulos Yibelo claims a KVM guest-to-host root escape zero-day found via Vercel’s Firecracker sandbox bounty.

Security researcher Paulos Yibelo says a Vercel bug-bounty submission uncovered a full guest-to-host root escape in Linux KVM, the hypervisor behind Firecracker MicroVMs. Vercel CEO Guillermo Rauch said the company confirmed a KVM zero-day affecting its Sandbox product, which runs AI-agent workloads in Firecracker. No CVE, patch, proof-of-concept, or mailing-list discussion is public, and exploitation has not been reported. KVM also underpins clouds and platforms from AWS, Google, Nutanix, HPE, and Proxmox; The Register notes Januscape as another serious KVM bug found this year.

The Register · SecurityOct 6, 02:06 UTC · 3d agoVulnerability 3 sources1

HPE Instant On AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

HPE patched 18 Instant On AP flaws, including unauthenticated remote code execution scored CVSS 9.8.

HPE advisory HPESBNW05150 covers 18 vulnerabilities in Networking Instant On access points running software 3.4.1.0 and earlier. CVE-2026-76721 and CVE-2026-76722, both CVSS 9.8, allow unauthenticated remote buffer-overflow code execution or format-string command execution. Three additional critical flaws scored 9.6 require adjacent-network access and can enable command injection, authentication bypass, or remote code execution. HPE said it was unaware of public exploit code as of September 29 and recommends upgrading to 3.4.2.0 or later, with automatic updates for eligible cloud-managed devices.

GBHackersOct 1, 08:01 UTC · 7d agoVulnerability CVE-2026-76721 CVE-2026-76722 CVE-2026-76723+15 CVEs

InfraTrust report warns network management systems under attack

Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.

An Eclypsium InfraTrust report highlights a trend of attackers targeting network management systems like Cisco FMC and ISE. Key vulnerabilities include CVE-2026-20079, an actively exploited authentication bypass, and CVE-2026-76460, a critical flaw added to the KEV catalog. Attackers are chaining flaws, using built-in tools, and deploying malware like a Cyclops Blink variant and Qilin ransomware. The trend extends to management software from other vendors, posing a significant risk to enterprise infrastructure.

BleepingComputerSep 23, 14:35 UTC · 15d agoVulnerability in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-76460+5 CVEs

HPE

Timeline4 articles

Related CVEsby mentions

Appears with

Security researcher claims to they found KVM guest-host escape flaw

Security researcher claims they found KVM guest-host escape flaw

HPE Instant On AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

InfraTrust report warns network management systems under attack