HPE patches critical iLO 7 authentication flaw

HPE released fixes for two remote management products: CVE-2026-79820 in iLO 7 (CVSS 9.0) lets an attacker gain admin access to the controller without credentials when used with Compute Ops Management, while CVE-2026-79842 in iMC (CVSS 9.1) is an authentication bypass. The flaws are fixed in iLO 7 version 1.25.01 and iMC 7.3 E0713; no confirmed exploitation has been reported.

• CVE-2026-79820 in iLO 7 is rated 9.0 under CVSS, classified CWE-287
• iLO 7 version 1.25.00 is affected when paired with Compute Ops Management
• CVE-2026-79842 in iMC scores 9.1 and is fixed in 7.3 E0713
• ZoomEye found 4,526 assets matching app="HPE iLO" and 18,272 by title="iLO"