ZDI 2026-03-03

ZDI-26-134: Hewlett Packard Enterprise AutoPass License Server Authentication Bypass Vulnerability

CVE-2026-23600

Machine-generated analysis · WAYSCloud LLM

The vulnerability enables remote authentication bypass on HPE AutoPass License Server without requiring any credentials.

Context

The affected product is Hewlett Packard Enterprise AutoPass License Server. The advisory describes an authentication bypass vulnerability that can be exploited remotely. The ZDI assigned a CVSS score of 7.3, indicating a medium to high severity. Worth noting that no authentication is required to exploit the vulnerability, as explicitly stated.

Operator considerations

Check: Verify if HPE AutoPass License Server is deployed in the environment.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-23600.

Read the full advisory on ZDI →