CVE-2026-76662

Executive Summary

CVE-2026-76662 is a buffer overflow vulnerability (CWE-121, stack-based buffer overflow) in HPE NonStop TELSERV, the terminal services component of the HPE NonStop (formerly Tandem) fault-tolerant server platform. A remote, unauthenticated attacker may trigger memory corruption that results in a denial-of-service condition against the affected service. With a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is network-reachable but requires non-trivial conditions to exploit, and its only demonstrated impact is loss of availability — no confidentiality or integrity impact, and no scope change.

Technical Analysis

CWE-121 describes a stack-based buffer overflow: input supplied to the vulnerable component is copied into a fixed-size stack buffer without adequate bounds checking, allowing data to overwrite adjacent stack memory. In CVE-2026-76662, the affected component is TELSERV, an HPE NonStop subsystem that provides terminal (Telnet-style) session services to the NonStop operating environment. Because TELSERV processes network-originated input, the overflow is reachable remotely over the network, consistent with the AV:N and PR:N (no privileges required) metrics.

The consequence stated by the vendor is memory corruption leading to a denial of service. Notably, the CVSS vector assigns A:H (high availability impact) but C:N/I:N — no confidentiality or integrity impact. Combined with the AC:H (high attack complexity) metric, this indicates that reliable triggering requires conditions outside the attacker's direct control, and that successful exploitation has not been demonstrated to achieve code execution or data disclosure. Such availability-only, high-complexity outcomes are typical of overflows that corrupt control data (for example a saved frame pointer or return address) in ways that terminate, hang, or crash the process rather than yielding a controllable hijack primitive.

Network positioning is significant. TELSERV commonly listens on well-known terminal-service ports within a NonStop environment, so exposure is typically limited to networks with routed access to the NonStop system or to any perimeter that allows the terminal-service port through. HPE NonStop systems are most frequently deployed in payment processing, transaction switching, and other high-availability workloads where service continuity is operationally critical — which raises the operational cost of an availability-only flaw well above what the raw 5.9 score suggests.

Insufficient technical detail is available to identify the specific input field, parser stage, buffer size, or code path involved, as the description provided does not enumerate them. This report therefore characterizes the vulnerability at the class and mechanism level rather than speculating about implementation specifics. CWE-121 identification confirms the overflow is stack-based rather than heap-based (CWE-122), which narrows the expected exploitation characteristics described above, but no further code-level detail can be asserted without evidence.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-76662, and CISA KEV does not list it. The attack chain below is inferred at the vulnerability-class level from the CWE-121 classification and the NVD description; it does not assert any specific function, parameter, or payload that is not present in the source data.

1. Reconnaissance / target identification. An attacker identifies a reachable HPE NonStop host exposing TELSERV terminal services. Discovery occurs through network scanning of the terminal-service port and through fingerprinting responses that identify NonStop TELSERV. Because exploitation is AV:N, no prior foothold on the host is required — only network reachability to the TELSERV listener. Systems behind strict segmentation that do not expose TELSERV are not reachable via this vector.

2. Triggering the flaw. The attacker sends crafted input to the TELSERV service over the network. Because the weakness is a stack-based buffer overflow (CWE-121), the input supplies more data to a fixed-length buffer than it can hold, overwriting adjacent stack memory. The AC:H rating indicates that the sequence, timing, or content required to reliably reach the vulnerable copy operation is not straightforward — blind attempts are unlikely to succeed consistently, and some fraction of attempts may be handled gracefully by the service.

3. Execution / effect. The overflow corrupts stack memory. The demonstrated outcome is memory corruption that manifests as a denial of service — the service crashes, hangs, or otherwise becomes unavailable. There is no evidence in the available data of a controlled write primitive, return-address redirection, or shellcode delivery resulting in code execution. Treating this as a DoS-class issue is consistent with the C:N/I:N/A:H vector.

4. Post-exploitation impact. The observable effect is loss of the TELSERV service on the target NonStop system, which may disrupt terminal sessions and dependent operational workflows. No lateral movement, credential theft, or data manipulation is supported by the provided data. Repeated triggering could sustain the outage, which is the primary persistence mechanism available to an attacker for an availability-only flaw.

Impact Assessment

The CVSS v3.1 base score of 5.9 reflects the following subscores, each of which shapes the practical risk:

• Attack Vector: Network (AV:N) — the flaw is triggerable across a network boundary with no local access.
• Attack Complexity: High (AC:H) — success depends on conditions the attacker does not fully control, reducing reliability and mass-exploitation potential.
• Privileges Required: None (PR:N) — no authentication or prior access is needed to attempt exploitation.
• User Interaction: None (UI:N) — no victim action is required.
• Scope: Unchanged (S:U) — impact is confined to the vulnerable TELSERV component.
• Confidentiality: None (C:N) — no data exposure demonstrated.
• Integrity: None (I:N) — no data modification demonstrated.
• Availability: High (A:H) — successful exploitation can render the service unavailable.

Business impact is concentrated on availability. HPE NonStop systems are typically deployed as high-value transaction and payment platforms where uptime is a core business requirement and, in some regulated environments, a compliance obligation. A denial of service against TELSERV can interrupt terminal access and operational workflows on such systems, escalating to service-level disruption if TELSERV is a dependency for other processes. Blast radius is bounded by the population of NonStop hosts that expose TELSERV to untrusted or semi-trusted networks; hosts with no network exposure to the service are out of reach. Because the flaw is unpatched with zero patch-confidence evidence, the exposure window remains open for every reachable instance.

No EPSS score has been assigned by FIRST.org, and no exploit-in-the-wild activity or threat-actor campaign is associated with this CVE in the available data.

Detection Guidance

Sigma Rule

title: Potential HPE NonStop TELSERV Buffer Overflow DoS Attempt
id: 6d2f9a41-3c7b-4e58-9a10-8f2c1b7e5d04
status: experimental
description: Detects repeated anomalous or oversized input directed at HPE NonStop TELSERV, consistent with CVE-2026-76662 buffer overflow attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76662
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: hpe_nonstop
detection:
  selection_event:
    EventID:
      - 5156
      - 5157
  selection_service:
    DestinationPort:
      - 23
      - 992
      - 653
  selection_volume:
    Initiated: 'true'
  timeframe: 5m
  condition: selection_event and selection_service and selection_volume | count() by SourceIp > 20
falsepositives:
  - Legitimate terminal session churn during batch operations
  - Vulnerability scanners performing service enumeration
level: medium
tags:
  - attack.t1499
  - cve.2026.76662

YARA Rule

rule CVE_2026_76662_NonStop_TELSERV_Overflow_Attempt
{
    meta:
        description = "Detects oversized input patterns consistent with HPE NonStop TELSERV stack buffer overflow (CVE-2026-76662) in captured or logged session data"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76662"
        cve = "CVE-2026-76662"
        date = "2026-01-01"

    strings:
        $tel = "TELSERV" ascii nocase
        $nsk = "NONSTOP" ascii nocase
        $repeat = /[A-Za-z0-9]{1024,}/

    condition:
        (uint16(0) == 0x0d0a or $tel or $nsk) and $repeat
}

Suricata IDS Rule

alert tcp any any -> any 23 (msg:"CVE-2026-76662 HPE NonStop TELSERV possible stack buffer overflow attempt"; flow:to_server,established; content:"TELSERV"; nocase; depth:64; pcre:"/.{2048,}/s"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:9000766; rev:1; metadata:cve CVE-2026-76662, mitre_tactic T1499;)

Elastic Detection

sequence by destination.ip with maxspan=2m
  [ network where network.transport == "tcp" and destination.port in (23, 992, 653) and event.action == "connection_started" ]
  [ network where network.transport == "tcp" and destination.port in (23, 992, 653) and network.bytes > 25000 ]

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=zeek_conn
| where match(dest_port, "^(23|992|653)$")
| stats count AS attempts, sum(bytes_out) AS total_bytes, dc(src_ip) AS sources BY dest_ip, dest_port
| where attempts > 20 OR total_bytes > 500000
| table dest_ip dest_port attempts total_bytes sources
| sort - attempts

Wazuh OSSEC Rule

<group name="hpe_nonstop,telserv,">
  <rule id="100766" level="8">
    <decoded_as>json</decoded_as>
    <match>TELSERV</match>
    <description>CVE-2026-76662: Suspicious input directed at HPE NonStop TELSERV - possible buffer overflow</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_76662,</group>
  </rule>
</group>

Note: the rules above are behavior-agnostic to the extent the source data permits. Because the NVD description does not disclose specific byte patterns, protocol fields, or payload signatures, they target the exploitation pattern (oversized or repeated input against the TELSERV terminal-service listener) and should be tuned to the actual protocol dialect in use before production deployment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available in the provided data. The guidance below is therefore risk-reduction rather than remediation, and should be validated against any forthcoming HPE advisory.

1. Immediate mitigations

• Restrict network reachability to the TELSERV listener. Permit only trusted management or operational subnets, and block terminal-service ports at perimeter and inter-zone boundaries where the service is not required.
• Apply rate limiting and connection throttling at the network edge for traffic destined to NonStop terminal services to blunt repeated triggering attempts.
• Monitor TELSERV availability and restart behavior; a crash-and-restart pattern is the most likely observable symptom of an attempt.
• Ensure NonStop system logging is forwarded to a central SIEM so that anomalous session volume and service restarts are correlated.

2. Patch / upgrade steps

• No fixed version is currently identified. Track HPE's NonStop product security advisory channel and the NVD entry for this CVE; apply vendor-supplied maintenance when it becomes available.
• When a patch is released, inventory all NonStop hosts running TELSERV, prioritize internet- or partner-facing instances first, then stage and validate in a non-production environment before fleet-wide rollout.

3. Long-term hardening

• Enforce network segmentation so that NonStop terminal services are never exposed beyond trusted zones.
• Adopt a vulnerability management workflow that treats availability-only, high-complexity flaws on transaction-critical platforms as high operational priority despite moderate CVSS scores.
• Maintain an accurate asset inventory of NonStop systems and their exposed listeners, and re-scan after any vendor advisory to confirm version coverage.
• Continue monitoring for exploit development; should a public PoC appear, re-evaluate detection thresholds and consider emergency network controls.

References

• NVD — CVE-2026-76662: https://nvd.nist.gov/vuln/detail/CVE-2026-76662
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• HPE Security Bulletins and Advisories (vendor advisory channel for HPE NonStop): https://support.hpe.com/connect/s/securitybulletinlibrary
• FIRST.org EPSS (no score currently assigned for this CVE): https://api.first.org/data/v1/epss?cve=CVE-2026-76662
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76662 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, public proof-of-concept, or named threat-actor campaign is associated with CVE-2026-76662 as of this report.