Is CVE-2020-7136 actively exploited?

Yes. CVE-2020-7136 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-7136 be exploited remotely?

The attack vector of CVE-2020-7136 has not been classified yet.

What is the CVSS score of CVE-2020-7136?

CVE-2020-7136 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-7136

UNKNOWNCISA KEVIN THE WILD

CVE-2020-7136

Published: April 11, 2026

EPSS:63.33%probability of exploitation in 30 daysPercentile:98.4th

Official Description

A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).

NVD Source

Risk Analysis

HPE Smart Update Manager (SUM) prior to version 8.5.6 has a security vulnerability that could allow remote unauthorized access. This flaw could enable an attacker to gain unauthorized entry to the system. Its inclusion in CISA's KEV catalog indicates confirmed real-world exploitation, making it an urgent concern.

This vulnerability has been actively exploited in the wild. It allows for remote unauthorized access to affected systems.

Recommended Action

Update HPE Smart Update Manager (SUM) to version 8.5.6 or later. Download the latest Service Pack For ProLiant (SPP) to ensure all components are updated.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-7136 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-7136 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.