{"id":"CVE-2026-95780","aliases":[],"cve":{"records":[{"id":"CVE-2026-95780","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:54:56.882Z","published":"2026-11-10T20:07:07.909Z","modified":"2026-11-10T20:07:07.909Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-10T20:07:07.909Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05179en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[],"applicability":[],"prioritization":[]},"title":"Authentication and Session Management Vulnerability Could Permit Continued Unauthorized Access","titleSource":"hpe","descriptionSource":"hpe","description":"A vulnerability exists in the authentication and session-management mechanisms that may result in access not being fully terminated following certain account or session state changes. Under specific conditions, a remote user with prior legitimate access could retain access to protected system resources beyond the intended authorization period. Successful exploitation could result in continued unauthorized access.","score":8.1,"severity":"high","published":"2026-11-10T20:07:07.909Z","modified":"2026-11-10T20:07:07.909Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Private 5G Core (P5G Core)","platforms":[],"versions":[{"version":"0.0.0.0","status":"affected","lessThanOrEqual":"1.26.1.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95780"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05179en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95780","modified":"2026-11-10T20:07:07.909Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95780"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1}],"sourceAffected":[],"observedAt":"2026-11-10T20:41:45.790Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-15T01:25:34.597Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-15T00:55:40.142Z","attemptedAt":"2026-11-15T00:55:40.142Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-15T00:55:35.759Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-15T00:55:38.239Z","attemptedAt":"2026-11-15T00:55:38.239Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95780","url":"https://www.first.org/epss/","probability":0.00408,"percentile":0.35637,"date":"2026-11-14","checkedAt":"2026-11-15T00:55:38.239Z"},{"source":"GitHub Advisory Database","id":"GHSA-x8qw-cq3f-gmwv","url":"https://github.com/advisories/GHSA-x8qw-cq3f-gmwv","modified":"2026-11-10T21:34:45Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-15T00:55:40.142Z"}],"aiSummary":{"text":"A vulnerability in HPE Private 5G Core versions up to 1.26.1.4 may allow a remote user with prior access to retain unauthorized access after certain account changes. The impact is continued unauthorized access. A remote user with prior legitimate access is required.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T10:56:03.919Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95780"}]}}