Security Bulletin released on February 19, 2026, addresses a remote flaw in HPE Telco Service Activator that could let attackers bypass access restrictions.
According to HPE, the issue stems from the Undertow HTTP server core used by the product.
The flaw is an improper input validation condition in which the server fails to validate the Host header in incoming HTTP requests correctly.
In real-world deployments, many applications and gateways rely on the Host header to enforce allowlists, route requests, or apply security rules.
| CVE ID | CVSS | Product | Component | Vulnerability Type | Attack Vector | Impact | Affected Versions |
|---|---|---|---|---|---|---|---|
| CVE-2025-12543 | 9.6 (Critical) | HPE Telco Service Activator | Undertow HTTP Server (core) | Improper Host Header Validation | Remote (HTTP request) | Access restriction bypass, potential unauthorized access | Versions prior to 10.5.0 |
When that header can be abused, an attacker may be able to reach functionality that should be blocked by host-based controls, effectively bypassing intended restrictions.
HPE rates CVE-2025-12543 with a CVSS v3.1 base score of and a vector of:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L.The “Network” vector and “No privileges required” indicate remote reachability without authentication.
While “User interaction required” suggests that exploitation may require a victim to take action, such as following a crafted link or triggering a specific request path via a browser or client workflow.
Impacted customers are those running HPE Telco Service Activator versions earlier than the current version. HPE states that updating to Telco Service Activator resolves the vulnerability.
Teams should prioritize upgrading TSA, especially where the interface is reachable from untrusted networks.
| Mitigation Step | Recommendation |
|---|---|
| Limit Exposure | Restrict access to VPN or admin networks only until patching is complete. |
| Reverse-Proxy Controls | Enforce strict host allowlists on reverse proxies. |
| Log Monitoring | Review web and application logs for unusual Host header values and unexpected routing behavior. |
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
