CVE-2026-63457: HPE iLO 6 DoS Vulnerability

CVE-2026-63457 Overview

CVE-2026-63457 is a denial of service vulnerability affecting HPE Integrated Lights-Out 6 (iLO 6) firmware versions prior to v1.78. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. An unauthenticated attacker on an adjacent network can trigger the condition without user interaction, disrupting the availability of the iLO management interface. iLO provides out-of-band server management for HPE servers, so loss of availability affects remote administration, monitoring, and recovery workflows.

Critical Impact
An adjacent-network attacker can render the iLO 6 management interface unavailable, disrupting out-of-band server administration on affected HPE servers.

Affected Products

HPE Integrated Lights-Out 6 (iLO 6) firmware versions prior to v1.78
HPE servers relying on iLO 6 for out-of-band management
Environments exposing iLO 6 management interfaces to shared administrative networks

Discovery Timeline

2026-08-05 - CVE-2026-63457 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-63457

Vulnerability Analysis

The vulnerability resides in HPE iLO 6 firmware prior to v1.78. It is classified as Uncontrolled Resource Consumption [CWE-400], a resource exhaustion category of denial of service. An attacker positioned on the same logical network segment as the iLO 6 management interface can send crafted traffic that consumes resources on the baseboard management controller. The condition requires no authentication and no user interaction. Successful exploitation degrades or halts the iLO 6 service, disrupting remote console access, virtual media, health monitoring, and firmware operations. Confidentiality and integrity of managed systems are not directly impacted by this issue.

Root Cause

The root cause is uncontrolled resource consumption within iLO 6 firmware handling of network-reachable services. The firmware fails to bound resources allocated when processing certain adjacent-network traffic. HPE addressed the issue in iLO 6 firmware v1.78. Refer to the HPE Security Advisory for vendor technical details.

Attack Vector

The attack vector is Adjacent Network. The attacker must have access to the same broadcast or management subnet as the iLO 6 interface. Many organizations segment iLO onto a dedicated management VLAN, which reduces but does not eliminate exposure. Any host compromised within that management network can reach iLO 6 and trigger the denial of service. No credentials or user interaction are required.

No public proof-of-concept code has been published for this vulnerability. See the HPE Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-63457

Indicators of Compromise

Unexplained loss of connectivity to the iLO 6 web interface, SSH, or IPMI services on affected servers
iLO event log entries showing service restarts, watchdog resets, or resource exhaustion warnings
Spikes in traffic directed at iLO management IP addresses from hosts within the management VLAN

Detection Strategies

Monitor iLO 6 firmware versions across the fleet and flag any device running a version earlier than v1.78
Baseline expected traffic to iLO management interfaces and alert on anomalous volume or unusual source hosts
Correlate iLO health telemetry with SNMP traps and syslog for reboot or unavailability patterns

Monitoring Recommendations

Ingest iLO syslog and Redfish event streams into a centralized logging platform for continuous review
Alert on repeated iLO service restarts or extended periods where the management interface is unreachable
Track access to the management VLAN and log all sessions from workstations and jump hosts

How to Mitigate CVE-2026-63457

Immediate Actions Required

Inventory all HPE servers using iLO 6 and identify units running firmware earlier than v1.78
Upgrade affected iLO 6 firmware to v1.78 or later using HPE's supported update tooling
Restrict iLO 6 network reachability to a dedicated, tightly controlled management VLAN
Validate iLO availability after the upgrade and confirm event logs are clean

Patch Information

HPE has released iLO 6 firmware v1.78, which resolves CVE-2026-63457. Administrators should apply the update through standard HPE firmware management workflows, including Service Pack for ProLiant (SPP), iLO Amplifier Pack, or direct Redfish-based deployment. Consult the HPE Security Advisory for the authoritative download and applicability matrix.

Workarounds

Isolate iLO 6 interfaces on a dedicated management network with strict access control lists
Permit iLO traffic only from designated administrative jump hosts and monitoring systems
Disable unused iLO network services and protocols to reduce the reachable attack surface
Enforce network segmentation policies that prevent general workstation subnets from reaching iLO IPs

bash

# Example: restrict access to the iLO management subnet at an upstream ACL
# Replace 10.10.50.0/24 with the iLO management subnet
# Replace 10.20.0.10/32 with an authorized admin jump host
access-list ILO_MGMT permit ip host 10.20.0.10 10.10.50.0 0.0.0.255
access-list ILO_MGMT deny   ip any 10.10.50.0 0.0.0.255 log
access-list ILO_MGMT permit ip any any