CVE-2026-23600 is a critical remote authentication bypass (CVSS 9.8) in HPE AutoPass License Server, known as APLS. The NVD record gives few details, so the fixed version is not stated here. Read HPE security bulletin hpesbgn05003en_us, then apply the update it names.
What's affected
The record names HPE AutoPass License Server and gives no version range. It describes a remote authentication bypass and nothing more about the cause.
We could not confirm the affected and fixed versions from the bulletin, so we do not state them. HPE's bulletin, identified as hpesbgn05003en_us on the HPE support site, is the authority. Check it for the exact versions and the update to install.
License servers are easy to forget. They run quietly for years, often on a shared host, and may be reachable from many internal networks.
How to check if you're exposed
Start with an inventory. Find hosts that run HPE AutoPass License Server and note the version each one reports. Then compare that against the versions listed in the HPE bulletin.
Next, check who can reach the server. A flaw that bypasses authentication over the network is most dangerous where the service is open to a wide set of clients. Review firewall rules and list which networks and hosts connect to its web interface or API ports.
If you cannot find the product by name, search for the installation directory and the service name on your servers, and ask the team that manages your HPE software licensing.
What to do now
- Locate every AutoPass License Server instance and its version.
- Open HPE bulletin hpesbgn05003en_us and note the fixed version.
- Apply the update during your next change window, or sooner given the severity.
- Restrict network access to the server to the hosts and admins that need it.
- Review the server for new accounts, changed licenses or unexpected logins since the issue was published.
Why it matters
The record lists CWE-287 (Improper Authentication). A check that is meant to establish who is calling does not do so, and a remote caller gets in without valid credentials.
With a CVSS score of 9.8, the vector shows network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The record does not say how the bypass works, and we do not guess. It does not mark this CVE as a CISA Known Exploited Vulnerability. Because details are thin, the safest path is to act on the vendor bulletin and limit exposure.
Quick check
Which version fixes it?
The record does not say. Check HPE bulletin hpesbgn05003en_us for the fixed version.
Why is the advice so general?
The NVD record has a one line description and the vendor page did not load for us, so we avoid stating anything we could not confirm.
Sources
Last reviewed: 19 October 2026.
