CVE-2026-76659

Executive Summary

CVE-2026-76659 is a missing-authentication vulnerability (CWE-306) in the finger daemon shipped with HPE NonStop TCP/IP UTILITIES that permits an unauthenticated remote attacker to trigger a denial of service. Any reachable HPE NonStop system exposing the finger service (TCP/79) is in scope, and exploitation requires no credentials, no user interaction, and no prior access. The impact is availability-only (CVSS 7.5, A:H), but because NonStop platforms frequently underpin payment, transaction, and settlement workloads, a successful attack can translate directly into business outage.

Technical Analysis

The vulnerability resides in the finger daemon component of HPE NonStop TCP/IP UTILITIES. The NVD description states only that an unauthenticated remote attacker can cause a denial of service; the vendor/CNA title field is empty and no affected version list, advisory text, or root-cause detail was published with this record. Accordingly, the analysis below is confined to what the assigned weakness classification supports rather than to specific routines in the daemon binary.

The assigned CWE is CWE-306: Missing Authentication for Critical Function. In the classic finger service model, the daemon listens on TCP port 79 and accepts an unauthenticated request line (the "user@host" query format defined for that protocol). The finger protocol has no native authentication layer and historically relies entirely on the daemon to limit the volume, size, and shape of queries it will service. CWE-306 in this context means the daemon performs a resource-exhausting or otherwise critical operation before — or entirely without — verifying that the requester is authorized to cause it. The DoS condition is therefore reachable pre-authentication by design: the attacker does not need to bypass a check, because the relevant function is exposed to the network without one.

CVSS scoring is consistent with this reading. AV:N confirms the attack is network-delivered; AC:L and PR:N confirm no preconditions such as credentials, privilege, or a race condition; UI:N confirms no victim action is needed; S:U confirms the impact stays within the daemon's own security scope rather than crossing a privilege boundary. Only the availability metric is affected (A:H, with C:N and I:N), which matches a resource-consumption or crash-style DoS rather than code execution or data disclosure. Notably, CVSS A:H rather than A:L implies the attacker can achieve a full loss of availability of the affected component, i.e., the finger service itself can be taken down completely, not merely degraded in a marginal way.

The attack surface is the finger service endpoint on the NonStop host. Because NonStop TCP/IP UTILITIES is a bundled networking stack rather than an optional middleware component, the exposure profile depends entirely on whether operators enabled and firewalled the finger listener. Finger is a legacy service; where it remains active it is generally unintentional drift from a default or historical configuration. That makes internet-reachable instances relatively rare but high-consequence when found, and internal-reachable instances common in flat enterprise networks.

Two important limitations must be stated explicitly. First, no technical root cause — no specific function, buffer, parsing routine, or input parameter — has been disclosed, and none is asserted here. Second, no public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing, so the precise trigger payload is unknown. The most defensible inference from CWE-306 plus an availability-only impact is one of two generic patterns: (a) the daemon performs an expensive or unbounded operation in response to an unauthenticated query, allowing resource exhaustion at the process, socket, or table level; or (b) the daemon mishandles a malformed or oversized unauthenticated query and terminates or becomes unresponsive. Both are consistent with the published data; neither can be distinguished without vendor detail.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (CWE-306) and the CVSS profile (AV:N/AC:L/PR:N/UI:N/A:H) rather than from disclosed technical artifacts. No specific function, endpoint, or parameter names are asserted because none appear in the NVD description or CNA title.

1. Reconnaissance and target identification. The attacker enumerates hosts with TCP port 79 open. Shodan and similar internet-wide scanners index port 79 services, and internal scanning using standard service discovery covers non-internet-facing instances. Finger responses are trivially distinguishable from other services on that port. The attacker correlates discovered hosts against known HPE NonStop deployments (frequently identifiable through banner, hostname, and naming conventions tied to transaction-processing environments) to prioritize targets.

2. Triggering the flaw class. Because the critical function lacks authentication (CWE-306), the attacker sends an unauthenticated finger request directly to TCP/79. No credentials, session, or handshake beyond the transport layer is required. At the vulnerability-class level, the request either induces an unbounded or expensive resource-consuming operation on the daemon side, or places the daemon into a state it does not handle safely. The attacker does not need to defeat any authorization check, which is the defining characteristic of this weakness class.

3. Payload/execution method. The exact payload is unknown absent vendor detail or a public PoC. The attacker's operational options are limited to: a single crafted query if the flaw is a deterministic crash condition, or request flooding/repetition if the flaw is resource exhaustion. Both are consistent with PR:N and AC:L. No code execution, file write, or authentication bypass beyond the DoS condition is implied by the score, and none should be assumed.

4. Post-exploitation impact. The immediate outcome is loss of the finger service on the target (A:H). Practical consequences escalate with architecture: if the daemon shares process, memory, or socket resources with co-resident TCP/IP UTILITIES components on the NonStop host, degradation may propagate beyond the finger service itself and affect dependent transaction or monitoring paths. There is no C:N or I:N impact, so no data is read or altered by this CVE; the attacker's payoff is disruption alone. Repeated or automated triggering can keep the service down for an extended period, converting a single-shot DoS into a sustained outage.

Impact Assessment

Business impact is availability-centric and can be material for organizations running HPE NonStop as a transaction or settlement backbone. A CVSS 7.5 with A:H means an unauthenticated attacker can fully deny the finger service with no user interaction and low attack complexity; the only mitigating factor is that exploitation is confined to the finger component's security scope (S:U) and does not disclose or modify data (C:N, I:N).

Affected systems are HPE NonStop hosts running TCP/IP UTILITIES with the finger daemon enabled and reachable. Because no affected version range was published, the blast radius cannot be bounded by release; any deployment that exposes finger must be treated as potentially in scope until the vendor clarifies. The practical blast radius is a function of two variables: how many instances are reachable (internet-facing instances are rare and should be zero; internal instances may be numerous) and how tightly the finger daemon is coupled to other services in the same networking stack.

Secondary impacts include: alert fatigue and triage cost from repeated DoS attempts; potential cascading failures in monitoring or management workflows that depend on the networking stack; and reputational or regulatory exposure if the outage touches regulated transaction processing. There is no CISA KEV listing and no EPSs score is available, so there is no evidence of active exploitation or weaponization. The threat is therefore best characterized as an exposure-management problem — an unnecessary legacy service that can be abused — rather than an active campaign.

Blast-radius containment depends on segmentation: a NonStop host whose finger port is firewalled to trusted management subnets has a materially smaller exposure than one on a flat internal network or, worse, the public internet.

Detection Guidance

Detection centers on monitoring TCP/79 for anomalous request patterns against HPE NonStop hosts and correlating daemon-level availability events. Because no exploit signature has been published, the rules below target the vulnerability class: pre-authentication access attempts and volumetric or malformed query activity against the finger service. Tuning is expected; baseline legitimate finger usage (if any) before enabling alerting.

Sigma Rule

title: HPE NonStop Finger Daemon Unauthenticated DoS Attempt (CVE-2026-76659)
id: 8f3c2a41-7d19-4b6e-9c02-5a7e1f9b3d44
status: experimental
description: Detects anomalous or high-volume unauthenticated access to the finger service (TCP/79) on HPE NonStop hosts, consistent with CWE-306 exploitation for denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76659
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026.76659
logsource:
  category: network_connection
  product: firewall
detection:
  selection_port:
    dst_port: 79
  selection_action:
    action:
      - allowed
      - accept
  timeframe: 5m
  condition: selection_port and selection_action | count() by src_ip > 50
falsepositives:
  - Authorized vulnerability scanners in an approved test window
  - Legitimate low-volume finger usage from legacy administration hosts
level: high

YARA Rule

rule CVE_2026_76659_NonStop_Finger_DoS
{
    meta:
        description = "Heuristic detection of finger daemon DoS tooling targeting HPE NonStop TCP/IP UTILITIES (CVE-2026-76659). No public PoC exists; rule targets generic finger flood tooling artifacts."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76659"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "finger" nocase
        $s2 = "NonStop" nocase
        $s3 = "/79" ascii
        $s4 = "79 " ascii
        $s5 = "finger@" nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and 2 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 79 (msg:"CVE-2026-76659 HPE NonStop Finger Daemon Unauthenticated DoS Attempt"; flow:to_server,established; dsize:>0; threshold:type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-76659; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76659; sid:202676659; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where destination.port == 79 and network.transport == "tcp" and event.action == "connection_accepted" ]
  [ network where destination.port == 79 and network.transport == "tcp" and event.action == "connection_accepted" ]
  [ network where destination.port == 79 and network.transport == "tcp" and event.action == "connection_accepted" ]

Splunk SPL Query

index=network sourcetype=firewall dest_port=79 action=allowed
| bucket _time span=1m
| stats count dc(src_ip) as unique_sources values(src_ip) as sources by dest_ip, _time
| where count > 50
| table _time dest_ip count unique_sources sources
| sort - count

Wazuh OSSEC Rule

<group name="hpe_nonstop,cve-2026-76659,denial_of_service,">
  <rule id="100766" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_port">79</field>
    <field name="action">allowed</field>
    <description>CVE-2026-76659: Possible unauthenticated finger daemon DoS attempt against HPE NonStop host (TCP/79)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the available data. The guidance below is therefore exposure reduction and compensating control, not remediation of the underlying defect.

1. Immediate mitigations.

• Disable the finger daemon on all HPE NonStop TCP/IP UTILITIES deployments where it is not operationally required. This is the single highest-value action: CWE-306 weaknesses in an unneeded network service are eliminated by removing the service, not by tuning it.
• Where finger cannot be disabled, restrict TCP/79 with host-based and network firewall rules to an explicit allowlist of trusted management hosts. Eliminate all internet-facing exposure immediately; any publicly reachable finger port should be treated as an incident.
• Enforce rate limiting or connection caps at the network edge for TCP/79 to blunt flooding-style exploitation even if the daemon itself cannot be hardened.
• Monitor and alert on the detection rules above to identify reconnaissance and exploitation attempts while the service remains reachable.

2. Patch/upgrade steps.

• No patched version is currently identified. Track the HPE Security Bulletin (support.hpe.com) and the HPE NonStop product security page for an advisory covering this CVE. HPE NonStop security bulletins are typically released under the "HPE NonStop" advisory series; enterprise change management should pre-stage a maintenance window so that an emergency patch can be applied quickly once released.
• Until a fix is published, re-validate the affected version inventory. Because no version range was provided in this CVE record, do not assume any release is unaffected — confirm exposure by port and service state rather than by version string.

3. Long-term hardening.

• Establish a service-inventory and port-exposure baseline for every NonStop host and treat legacy services (finger, echo, chargen, daytime, and similar) as default-deny. New listeners should require an explicit business justification and a firewall exception record.
• Segment transaction-processing and settlement hosts from general corporate networks, with strict east-west controls, so that a DoS against one networking-stack service cannot cascade to adjacent workloads.
• Adopt a vulnerability-management cadence that flags CVEs with CWE-306 and A:H availability profiles as "remove or firewall first" items, independent of patch availability.
• Integrate CVE monitoring into change-management so that when the HPE advisory lands, the patch is applied under a pre-approved emergency change rather than discovered late.

References

• NVD — CVE-2026-76659: https://nvd.nist.gov/vuln/detail/CVE-2026-76659
• CWE-306: Missing Authentication for Critical Function — https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
• HPE Security Bulletins (vendor advisory portal) — https://support.hpe.com/ (search "NonStop" security bulletins)
• FIRST EPSS — score not yet available for this CVE at time of writing: https://api.first.org/data/v1/epss?cve=CVE-2026-76659
• No CISA KEV listing; no known threat actor campaign or in-the-wild exploitation evidence available in the provided data.