CVE-2020-7200

CRITICAL

HPE Systems Insight Manager 7.6 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2020-7200. PoCs published by alexfrancow, Harrison Neal, Jang, Grant Willcox, including Metasploit module exploits/windows/http/hpe_sim_76_amf_deserialization.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-7200, a deserialization vulnerability in HPE Systems Insight Manager (SIM) 7.6. The exploit leverages Apache Commons Collections and Javassist to craft a malicious serialized object that achieves remote code execution when deserialized by the vulnerable `simsearch.war` component.

Description

A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote code execution.

Exploits (2)

nomisec WORKING POC 6 stars
by alexfrancow · poc
https://github.com/alexfrancow/CVE-2020-7200

This repository contains a functional exploit for CVE-2020-7200, a deserialization vulnerability in HPE Systems Insight Manager (SIM) 7.6. The exploit leverages Apache Commons Collections and Javassist to craft a malicious serialized object that achieves remote code execution when deserialized by the vulnerable `simsearch.war` component.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: HPE Systems Insight Manager 7.6
No auth needed
Prerequisites: Access to the vulnerable HPE SIM server · Network connectivity to the target on port 50000
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Harrison Neal, Jang, Grant Willcox · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hpe_sim_76_amf_deserialization.rb

This Metasploit module exploits a deserialization vulnerability in HPE Systems Insight Manager 7.6.x via a crafted POST request to the AMF endpoint, leading to remote code execution with administrative privileges.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HPE Systems Insight Manager 7.6.x
No auth needed
Prerequisites: Network access to the target server · HPE SIM 7.6.x running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.8189
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
hp/systems_insight_manager 7.6
Published Dec 18, 2020
Tracked Since Feb 18, 2026