HPE AutoPass Vulnerability Let Attackers Bypass Authentication Remotely

A security bulletin has been issued regarding a vulnerability in the AutoPass License Server (APLS) that could allow attackers to remotely bypass authentication controls.

The issue is tracked as CVE-2026-23600 and is rated important with a CVSS  base score of 7.3.

According to HPE, the flaw could be exploited over the network without requiring privileges or user interaction, enabling an authentication bypass.

In practice, if an APLS instance is reachable from untrusted networks, an attacker may be able to access protected functions without valid credentials.

Potentially leading to exposure or manipulation of licensing-related operations and associated server data.

CVE	Product	Affected versions	Impact	CVSS v3.1 vector	CVSS score
CVE-2026-23600	HPE AutoPass License Server (APLS)	Prior to 9.19	Remote authentication bypass	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	7.3

HPE credits “Anonymous working with TrendAI Zero Day Initiative” for reporting the issue to HPE’s Product Security Response Team (PSRT). The company has published guidance and a fixed release to address the vulnerability.

Only versions before HPE AutoPass License Server are affected. HPE states that the issue can be exploited remotely to bypass authentication.

An organization exposes the license server interface to broad network segments “for convenience,” and an external attacker targets it to bypass login controls and access the service remotely.

HPE’s primary remediation is to upgrade to HPE AutoPass License Server or later.

Additional defensive actions while you patch:

Security Measure	Recommendation
Restrict Network Exposure	Allow access only from trusted admin subnets or VPNs and block internet-facing access at firewalls.
Review Authentication & Access	Audit admin access paths, remove unused accounts, and enforce the principle of least privilege.
Monitor Suspicious Activity	Watch for unusual access patterns such as unexpected source IPs, traffic bursts, or off-hours admin activity.
Apply Host OS Patches	Ensure third-party patches are applied to the host OS according to patch management policies to reduce follow-on risk.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.