CVE-2016-4368

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-08 · updated 2026-06-17
Weakness: CWE-20

Description

HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

HP Universal Cmbd Configuration Manager: 10.0, 10.01, 10.10, 10.11, 10.20, 10.21
HP Universal Cmbd Foundation: 10.0, 10.01, 10.10, 10.11, 10.20, 10.21
HP Universal Discovery: 10.0, 10.01, 10.10, 10.11, 10.20, 10.21

References

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408

Get alerted when CVE-2016-4368 or the next vulnerability affects your stack