HPE iLO 5 < 3.22 / iLO 6 < 1.79 / iLO 7 < 1.25.01 Multiple Vulnerabilities (HPESBHF05170)

critical Nessus Plugin ID 366538

Language:

Synopsis

The remote HPE Integrated Lights-Out (iLO) server is affected by multiple vulnerabilities.

Description

The version of HPE Integrated Lights-Out (iLO) firmware on the remote host is iLO 5 prior to 3.22, iLO 6 prior to 1.79, or iLO 7 prior to 1.25.01. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBHF05170 advisory. A remote attacker can exploit these vulnerabilities to cause a denial of service or to bypass authentication.

Note that iLO 7 is not affected by CVE-2026-65204.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade HPE iLO 5 firmware to version 3.22 or later, iLO 6 firmware to version 1.79 or later, or iLO 7 firmware to version 1.25.01 or later.

Plugin Details

Severity: Critical

ID: 366538

File Name: ilo_HPESBHF_05170.nasl

Version: 1.3

Type: Remote

Family: CGI abuses

Published: 10/16/2026

Updated: 10/22/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.41

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-65206

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:hp:integrated_lights-out_5_firmware, cpe:/o:hp:integrated_lights-out_firmware

Required KB Items: www/ilo, ilo/generation, ilo/firmware

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/13/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-65204, CVE-2026-65205, CVE-2026-65206, CVE-2026-65207, CVE-2026-65208, CVE-2026-65209

HP: HPESBHF05170

IAVA: 2026-A-1123

Detections

Analytics