HPE iLO 6 (denial of service): An unauthenticated attacker on an adjacent network can knock out iLO 6 availability

Impact

An unauthenticated attacker on an adjacent network can knock out iLO 6 availability. No data is read or written - the damage is losing the out-of-band plane itself. For a GPU fleet that is a real operational hit rather than a cosmetic one: when iLO is down you cannot power-cycle a hung training node, cannot console into it to see why the job died, and cannot push firmware or re-provision it. A coordinated version of this against a rack turns a recoverable incident into a physical dispatch. Affects iLO 6 before v1.78, so it covers the Gen11 fleet.

Who can reach it

Adjacent network, unauthenticated - anything sharing the management segment with the iLOs. No account, no host access, no user interaction.

What to do

Flash iLO 6 to v1.78 or later. Out-of-band, per-node, no host reboot and no job drain - which makes this a cheap fix relative to the availability risk it removes. Because the vector is adjacent-network and unauthenticated, network segmentation is the meaningful compensating control while the rollout runs: keep BMCs off any segment shared with general-purpose hosts.

References

Related entries

• Dell OpenManage Enterprise: XML external entity processing exposes information to a low-privileged userCVE-2026-70423 · Dell OpenManage Enterprise (XML external entity processing)Medium
• Dell OpenManage Enterprise: path traversal exposes information to a low-privileged remote userCVE-2026-70424 · Dell OpenManage Enterprise (path traversal in a restricted-directory check)Medium
• Arista EOS: DHCP relay forwards replies from unconfigured servers, allowing client config spoofingCVE-2026-73437 · Arista EOS DHCP relay (helper-address source validation)Medium
• Dell OMSA: authenticated path traversal lets a low-privileged user read files off the nodeCVE-2026-81453 · Dell OpenManage Server Administrator (path traversal, authenticated)Medium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-003-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-006-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium