CVE-2016-4368: HP Universal Cmbd Configuration Manager

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

• HP Universal Cmbd Configuration Manager: version 10.0 only; version 10.01 only; version 10.10 only; version 10.11 only; version 10.20 only; version 10.21 only
• HP Universal Cmbd Foundation: version 10.0 only; version 10.01 only; version 10.10 only; version 10.11 only; version 10.20 only; version 10.21 only
• HP Universal Discovery: version 10.0 only; version 10.01 only; version 10.10 only; version 10.11 only; version 10.20 only; version 10.21 only

Published 2016-06-08. Last modified 2026-06-17.