Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
CRITICAL severity

CVE-2016-2004 — Data Protector

CRITICAL

CVE-2016-2004 is a critical-severity (CVSS 9.8) Missing Authentication vulnerability in hp data protector. 6 public exploit references exist, so weaponization risk is real. A fix is available — see the affected versions and patch details below.

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication.…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
6 known
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
94.3%probability of exploitation in next 30 days
Very High Risk0.00%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
92.2%93.1%93.9%94.8%92.7%94.3%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2016-2004 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 394,415 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.

Description

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.

Affected Products

1 product · 3 configurations
Application
data protectorhp
≥ 9.0 && < 9.06
range
Exploits & PoCs
6

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-39858remotewindows✓ Verified

HP Data Protector A.09.00 - Arbitrary Command Execution

by Ian Lovering · May 26, 2016

Exploit-DB Source
EDB-39874remotewindows✓ Verified

HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)

by Ian Lovering · May 31, 2016

Exploit-DB Source

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every hp data protector deployment and check each version against the affected-products list above.

  2. Fix

    Apply the hp data protector security patch or hotfix for CVE-2016-2004 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
O3 Security · Runtime Protection

Is CVE-2016-2004 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2016-2004: Data Protector (Critical 9.8)