# CVE-2026-44875: HPE Cray Programming Environment privilege escalation

Source: https://junglewise.ai/threats/cve-2026-44875-in-hpe-cray-programming-environment-versions-25-03-and-25-09  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-44875 · Severity: info · Published 2026-11-05

HPE Cray Programming Environment (CPE) is used for compiling and deploying high-performance computing applications. A local unprivileged user on the host system can escalate their privileges through a flaw in how CPE is deployed on HPE Cray systems. An attacker with local access could gain elevated system permissions, potentially compromising the entire computing environment.

Vendors: [Hpe](https://junglewise.ai/threats/vendors/hpe).

## Quick answers

**Is CVE-2026-44875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44875 being exploited in the wild.

**How severe is CVE-2026-44875?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Hpe Cray Programming Environment 25.03, 25.09.

**Is there a fix for CVE-2026-44875?** Yes: fixed in 26.03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44875 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-44875?** Check whether you run Hpe Cray Programming Environment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.03

## Technical details

A privilege escalation vulnerability exists in the deployment method of Cray Programming Environment on HPCM systems. The vulnerability is triggered locally by an unprivileged user and allows elevation to higher privileges. The issue affects CPE versions 25.03 and 25.09, and is resolved in version 26.03.

## Affected products

- HPE Cray Programming Environment 25.03, 25.09

## Timeline

- 2026-11-05: disclosed

## References

- [https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr05046en_us&docLocale=en_US](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr05046en_us&docLocale=en_US)