CVE-2026-73794

Executive Summary

CVE-2026-73794 is a predictable seed vulnerability (CWE-337) in the Random Number Generation (PRNG) used by HPE NonStop MODULAR NSJ. Because the seed used to initialize the generator is predictable, values that the product treats as random may be guessable by an attacker who can observe or model the generation context. The issue is rated CVSS 3.1 base 4.6 (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L), reflecting a network-reachable but high-complexity attack requiring low privileges and user interaction, with limited confidentiality, integrity, and availability impact. No public PoC, Nuclei template, or exploit code exists, and the vulnerability is currently unpatched.

Technical Analysis

The vulnerability class is a predictable seed in a pseudo-random number generator. A PRNG is deterministic: given an identical internal state (seed), it produces an identical output sequence. If the seed is derived from an easily predicted or low-entropy source — for example a fixed value, a coarse timestamp, a process identifier, or another observable quantity — an attacker who can approximate that source can reproduce the generator's state and predict its future outputs. This defeats any security control that depends on the "randomness" of those outputs, such as session identifiers, tokens, nonces, cryptographic key material derived from the PRNG, or randomized allocation decisions.

For CVE-2026-73794, the affected component is the Random Number Generation facility within HPE NonStop MODULAR NSJ. The NVD description confirms the flaw is a predictable seed but does not disclose the exact seeding source, the PRNG algorithm, the state size, or the specific consumer of the generated values. Those implementation specifics are not available and should not be assumed. What can be stated at the vulnerability-class level is the following:

• The security weakness exists in the seed/initialization stage, not necessarily in the PRNG algorithm itself. A cryptographically strong algorithm seeded predictably is still fully predictable.
• The vulnerable surface is any externally reachable function or service that consumes PRNG output and presents it to, or relies on its unpredictability against, a remote party.
• The attack is network-capable (AV:N) but of high complexity (AC:H), consistent with an adversary needing to model or partially observe the seeding conditions rather than simply sending a crafted request.
• Low privileges (PR:L) and user interaction (UI:R) are required, indicating the attacker likely needs some existing access or must induce a legitimate user or process action to trigger generation in an observable context.

No function names, class names, endpoints, or parameters are provided in the source data, so no code-level path is asserted here. The absence of a public advisory with technical detail means defenders should treat the precise trigger as environment-dependent and prioritize detection at the class level: anomalous prediction, replay, or reuse of values that should be random.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (predictable PRNG seed) and the CVSS metrics.

1. Reconnaissance / target identification. The attacker identifies an exposed HPE NonStop MODULAR NSJ deployment whose externally reachable functionality depends on PRNG-generated values. Because the flaw is network-reachable (AV:N) but high-complexity (AC:H), the attacker must first map which responses, tokens, or identifiers are derived from the generator and determine whether the seeding conditions are observable or reproducible.

2. Triggering the flaw class. The attacker causes the target to generate values using the predictably seeded PRNG — for example, by initiating a session, requesting a token, or otherwise invoking a feature whose output is PRNG-derived. The UI:R metric suggests this may require a legitimate user action or a valid workflow step that the attacker can induce or observe.

3. Prediction / reconstruction. Using knowledge of the predictable seed (for example, an approximated initialization time or other low-entropy input), the attacker reconstructs the PRNG state and computes candidate outputs. This step is class-level: it does not depend on any specific undocumented function or parameter, only on the fact that seed → state → output is deterministic.

4. Post-exploitation impact. With predictable outputs, the attacker can guess or forge values that the system and its users treat as unguessable — for example, impersonating a session, replaying or pre-computing an expected value, or bypassing a control that assumes unpredictability. The CVSS subscores cap this at limited confidentiality (C:L), integrity (I:L), and availability (A:L) impact with scope unchanged (S:U), so exploitation yields partial, bounded compromise rather than full system takeover.

Note: no specific endpoints, identifiers, or token formats are disclosed in the available data, so the above remains at the vulnerability-class level.

Impact Assessment

Successful exploitation weakens the unpredictability guarantee that underpins one or more security controls in HPE NonStop MODULAR NSJ. The practical business impact is bounded but real:

• Confidentiality (C:L): an attacker may gain limited insight into data protected by PRNG-derived secrets (for example, guessing a token or identifier).
• Integrity (I:L): an attacker may be able to supply or forge values the system accepts as legitimate.
• Availability (A:L): limited disruption is possible, though no denial-of-service mechanism is described.
• Scope is Unchanged (S:U): the vulnerable component's compromise does not, per the vector, cascade to other components.

Blast radius is constrained by the high attack complexity and the requirement for low privileges plus user interaction. Systems that expose PRNG-dependent functionality to untrusted networks are most at risk; isolated or segment-restricted deployments face reduced exposure. Because no affected version ranges have been published, the exact set of vulnerable NonStop MODULAR NSJ builds cannot be enumerated from the available data, and administrators should consult HPE directly for applicability.

Detection Guidance

Sigma Rule

title: Potential Predictable PRNG Exploitation - HPE NonStop MODULAR NSJ (CVE-2026-73794)
id: 8f2a1c74-3e6b-4d2f-9a10-7c5b2e9d4f01
status: experimental
description: Detects anomalous repetition or prediction patterns consistent with abuse of a predictably seeded PRNG in HPE NonStop MODULAR NSJ.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73794
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: hpe_nonstop
detection:
  selection_event:
    EventID:
      - 1001
      - 1002
    Message|contains:
      - 'PRNG'
      - 'random'
      - 'seed'
  selection_anomaly:
    Message|contains:
      - 'token reuse'
      - 'duplicate nonce'
      - 'repeated value'
  condition: selection_event and selection_anomaly
falsepositives:
  - Legitimate diagnostic logging of PRNG statistics
level: low
tags:
  - attack.t1592
  - cve.2026.73794

YARA Rule

rule CVE_2026_73794_PRNG_Predictable_Seed_Indicator
{
    meta:
        description = "Heuristic indicator for predictable PRNG seed references in HPE NonStop MODULAR NSJ artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73794"
        date = "2026-01-01"
        cve = "CVE-2026-73794"

    strings:
        $a = "Random Number Generation" ascii nocase
        $b = "predictable seed" ascii nocase
        $c = "MODULAR NSJ" ascii nocase
        $d = "srand" ascii
        $e = "seed" ascii nocase

    condition:
        uint16(0) == 0x5A4D and (2 of ($a, $b, $c)) or (1 of ($a, $c) and any of ($d, $e))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-73794 Possible Predictable PRNG Abuse HPE NonStop MODULAR NSJ"; flow:to_server,established; content:"MODULAR NSJ"; nocase; http_header; reference:cve,2026-73794; classtype:attempted-recon; sid:2026737941; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ any where process.name : "*" and process.command_line : "*PRNG*" ]
  [ any where event.action : "token_generated" and event.outcome : "success" ]

Splunk SPL Query

index=hpe_nonstop sourcetype=modular_nsj:*
| search ("PRNG" OR "random" OR "seed")
| stats count AS events, dc(value) AS distinct_values BY src_ip, user
| where events > 20 AND distinct_values < 5
| sort - events

Wazuh OSSEC Rule

<group name="hpe_nonstop,cve-2026-73794,">
  <rule id="100737" level="5">
    <decoded_as>json</decoded_as>
    <field name="event.category">application</field>
    <match>PRNG|predictable seed|random</match>
    <description>CVE-2026-73794: Possible predictable PRNG activity in HPE NonStop MODULAR NSJ</description>
    <mitre>
      <id>T1592</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available.

1. Immediate mitigations:

   • Restrict network exposure of HPE NonStop MODULAR NSJ interfaces to trusted segments; the AV:N metric means remote reachability materially increases risk.
   • Enforce least privilege and minimize the number of accounts (PR:L) and workflows (UI:R) that can trigger PRNG-dependent functionality.
   • Where possible, substitute or wrap PRNG-derived security values with values from an OS-level cryptographically secure random source if the platform permits, and treat existing PRNG-derived tokens as compromised if predictability is suspected.
   • Increase monitoring for token/value reuse and repeated outputs (see Detection Guidance).

2. Patch / upgrade steps:

   • No patch is available from any tracked source. Monitor HPE's official NonStop security bulletins and the NVD entry for CVE-2026-73794, and apply the vendor fix as soon as it is released.
   • Until then, treat all deployments as potentially affected; contact HPE support to confirm whether a given NonStop MODULAR NSJ build is impacted and whether an interim hardening update exists.

3. Long-term hardening:

   • Require CSPRNG-sourced seeding (high-entropy, non-guessable) for all security-relevant random values, and validate this through code review and configuration baselines.
   • Rotate any secrets, tokens, or identifiers that may have been generated with the predictable PRNG.
   • Maintain a software bill of materials and version inventory for NonStop MODULAR NSJ to enable rapid response once an advisory or patch is published.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73794
• CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG): https://cwe.mitre.org/data/definitions/337.html
• HPE Security Bulletins (vendor advisory portal): https://support.hpe.com/
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-73794 current score 0.00179)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-73794 not listed)

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-73794 at this time.