CVE-2020-7136: HPE Smart Update Manager remote unauthorized access flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with a network, unauthenticated, no-interaction vector and very high EPSS make this an urgent patch target despite the thin description.

What it is

HPE Smart Update Manager (SUM) before version 8.5.6 contains a flaw that could allow remote unauthorized access. The vendor description is thin and does not name the root cause, but the critical CVSS score and network vector indicate a serious exposure for anyone running an unpatched SUM instance.

Impact

An unauthenticated remote attacker could gain unauthorized access to the affected SUM deployment, with the CVSS vector indicating high impact to confidentiality, integrity and availability.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The record does not specify which SUM interface or service is exposed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high at roughly 0.795 (99.6th percentile), suggesting elevated real-world exploitation likelihood.

What to do

• Upgrade HPE Smart Update Manager to version 8.5.6 or later, or apply the latest Service Pack for ProLiant (SPP) as directed by the vendor advisory.
• If SUM cannot be patched immediately, restrict network access to its management interfaces to trusted hosts only.
• Do not expose SUM management ports to untrusted networks or the internet.
• Verify the deployed SUM version against the vendor advisory and track completion of upgrades.
• Monitor the HPE support advisory for any updated guidance.

Detection

• Inventory hosts running HPE Smart Update Manager and flag any version below 8.5.6.
• Monitor network logs for unexpected inbound connections to SUM management ports from untrusted sources.
• Review SUM and host logs for anomalous administrative or update actions originating from remote addresses.
• Alert on new or unusual processes spawned by SUM services on managed hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.