HPE Security Advisory
Published Date: June 25, 2026
Advisory Summary
HPE has issued revision 2 of advisory HPESBHF05041 addressing a critical local arbitrary code execution vulnerability impacting certain HPE SimpliVity servers equipped with specific AMD EPYC processors. The issue stems from an incorrect use of the LocateProtocol service within the EFIBOOTServices table during the System Management Interrupt (SMI) handler process. This vulnerability, identified under AMD-SB-7054, could potentially allow attackers with local access to execute arbitrary code at a highly privileged level, posing serious risks to server integrity and operational security.
IT infrastructure teams operating HPE SimpliVity environments utilizing these AMD EPYC models should prioritize applying the recommended patches and firmware updates outlined in this advisory to mitigate exploitation risks. Given the criticality, validate your affected systems promptly and review access controls to minimize local attack vectors.
For data center and enterprise IT professionals, this vulnerability highlights the ongoing need for vigilance in firmware and management service security within mixed hardware ecosystems combining HPE and AMD technologies.
🛠️ Immediate action is recommended: implement the fixes provided by HPE to safeguard your SimpliVity infrastructure and maintain secure, reliable operations.
Reference: Vendor Advisory