CVE-2026-23600 – HPE AutoPass License Server – Remote Authentication Bypass

This update addresses CVE-2026-23600, a critical vulnerability in HPE AutoPass License Server (APLS) that allows remote authentication bypass. The flaw exists within the server’s authentication validation process, enabling attackers with network access to access protected services without valid credentials. Because APLS manages enterprise licensing and administrative functions, unauthorized access could allow attackers to manipulate licensing operations, alter configuration settings, or disrupt licensing services across enterprise systems.

CVE-2026-23600 — CVSS v3.1 Score: 10.0 (Critical). The vulnerability affects HPE AutoPass License Server versions prior to 9.19. The flaw can be exploited remotely and requires no privileges or user interaction, allowing attackers to fully bypass authentication controls and access restricted administrative capabilities. The issue creates a direct exposure of licensing infrastructure that could lead to service disruption or broader system compromise if exploited. HPE resolved the vulnerability in AutoPass License Server version 9.19.