CVE-2026-79820 and the Two Faces of HPE Remote Management: iLO 7 and iMC

One bulletin, two products

HPE published fixes covering two remote management products in the same advisory cycle. The first is an authentication flaw in Integrated Lights-Out 7, tracked as CVE-2026-79820 and scored 9.0 under CVSS v3. The second is CVE-2026-79842, an authentication bypass in HPE Intelligent Management Center scored 9.1. This article focuses on the iLO 7 issue while keeping the second in view, since both control privileged access to infrastructure.

The iLO 7 flaw

CVE-2026-79820 is classified as CWE-287 for improper authentication. It affects iLO 7 version 1.25.00 when the controller is used with HPE Compute Ops Management, and HPE states that it can be exploited remotely to obtain administrative-level access to iLO without credentials.

Exploitation conditions and impact

The affected release, the Compute Ops Management configuration, and reachability must all be present. HPE rates the complexity as high and records a changed scope in the CVSS vector. Administrative access to iLO permits changes to power state, boot configuration, virtual media, and firmware, none of which are removed by reinstalling the operating system.

Affected products and scope

The vulnerable release is iLO 7 version 1.25.00, fixed in version 1.25.01 or later. The iMC flaw is fixed in version 7.3 E0713. HPE reports no confirmed exploitation for either issue and no public proof of concept.

Exposure context

A ZoomEye query for app="HPE iLO" returned 4,526 matching assets, while title="iLO" returned 18,272. The counts describe internet-visible interfaces matching the fingerprint. They cannot distinguish firmware versions or management configurations, and they do not tell you whether a specific host is affected.

Remediation and mitigations

Update iLO 7 to version 1.25.01 or later and iMC to version 7.3 E0713 from the HPE Support Center, then verify both builds. Because both products grant privileged access, keep them on isolated management networks and restrict the set of hosts allowed to reach them. Confirm which administrative accounts can authenticate so the access list can be reviewed rather than assumed.