Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where system encounter a Red Screen of Death(RSOD) when booting Windows Server 2022 after the Microsoft Windows Production PCA 2011 certificate had been removed from the Secure Boot DB.

Known Issues:

• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

No fixes are included in version 16.35.8008.

The following issues have been fixed in version 16.35.8002:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

• Traffic failure occurred when modifying the VIRTIO_NET_F_MRG_RXBUF bit for the VDPA device during traffic.
• The second mkey index returned even if it was not set in the creation of the virtio q when querying virtio q object.
• Traffic loss occurred after performing Live Migration with virtio vq "frozen-ready" feature.

Note: When the traffic load is high, and the vq frozen-ready cap is on, traffic loss might still be experienced after modifying the vq from suspend to ready mode.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM failed Secure Boot certificate validation, preventing the system from binding a driver to the NVMe controller.

Addressed a potential system stability issue during boot caused by a NULL pointer dereference in the event logging code path when a memory allocation failure occurred.

Addressed the following security vulnerabilities:

- CVE-2026-7383 (OpenSSL)

- CVE-2026-33416 (Libpng)

- CVE-2026-34757 (Libpng)

- CVE-2014-9485 (MiniZip)

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved a security vulnerability where a NULL pointer dereference could cause a system crash during boot if an internal memory allocation failed during the ExitBootServices or boot option launch sequence.

Addressed an issue where the Minimum Processor Idle Power Core C-State and Minimum Processor Idle Power Package C-State options were not appearing in System Configuration (RBSU) under Power and Performance Options on ML30 Gen10 and DL20 Gen10 platforms.

Known Issues:

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 05.01.05.103.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Mitigates CVE-2024-38798 through an EDK2 fix that clears password keystroke buffers after entry to avoid potential information disclosure.

Addressed ESKM key generation/shortening issue to prevent SED unlock failures by validating/regenerating malformed keys.

Fixed Power Calibration retry handling bug that could prevent expected power calibration behavior when requested by iLO.

Known Issues:

None

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• Code optimization to save memory repo.

• TLB exception seen while doing esp reset when expander reset was in progress.

• Added the psoc 8.93 binary in peripheral images, updated the reveille version numbers.

• Added whole new Delta PS-pmbus code , Updated the ESP version number.

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved a security vulnerability where a NULL pointer dereference could cause a system crash during boot if an internal memory allocation failed during the ExitBootServices or boot option launch sequence.

Addressed an issue where the Minimum Processor Idle Power Core C-State and Minimum Processor Idle Power Package C-State options were not appearing in System Configuration (RBSU) under Power and Performance Options on ML30 Gen10 and DL20 Gen10 platforms.

Known Issues:

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 05.01.05.103.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Mitigates CVE-2024-38798 through an EDK2 fix that clears password keystroke buffers after entry to avoid potential information disclosure.

Addressed ESKM key generation/shortening issue to prevent SED unlock failures by validating/regenerating malformed keys.

Fixed Power Calibration retry handling bug that could prevent expected power calibration behavior when requested by iLO.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

No fixes are included in version 16.35.8008.

The following issues have been fixed in version 16.35.8002:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

No fixes are included in version 16.35.8008.

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

No fixes are included in version 16.35.8008.

The following issues have been fixed in version 16.35.8002:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved a security vulnerability where a NULL pointer dereference could cause a system crash during boot if an internal memory allocation failed during the ExitBootServices or boot option launch sequence.

Addressed an issue where the Minimum Processor Idle Power Core C-State and Minimum Processor Idle Power Package C-State options were not appearing in System Configuration (RBSU) under Power and Performance Options on ML30 Gen10 and DL20 Gen10 platforms.

Known Issues:

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 05.01.05.103.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Mitigates CVE-2024-38798 through an EDK2 fix that clears password keystroke buffers after entry to avoid potential information disclosure.

Addressed ESKM key generation/shortening issue to prevent SED unlock failures by validating/regenerating malformed keys.

Fixed Power Calibration retry handling bug that could prevent expected power calibration behavior when requested by iLO.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM failed Secure Boot certificate validation, preventing the system from binding a driver to the NVMe controller.

Addressed a potential system stability issue during boot caused by a NULL pointer dereference in the event logging code path when a memory allocation failure occurred.

Addressed the following security vulnerabilities:

- CVE-2026-7383 (OpenSSL)

- CVE-2026-33416 (Libpng)

- CVE-2026-34757 (Libpng)

- CVE-2014-9485 (MiniZip)

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

None

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where system encounter a Red Screen of Death(RSOD) when booting Windows Server 2022 after the Microsoft Windows Production PCA 2011 certificate had been removed from the Secure Boot DB.

Known Issues:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

• Temperature sensors logic inside gSEP model and SES database
• When an IOM is pulled the surviving IOM reports false critical temperatures

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

• Temperature sensors logic inside gSEP model and SES database
• When an IOM is pulled the surviving IOM reports false critical temperatures

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

• Temperature sensors logic inside gSEP model and SES database
• When an IOM is pulled the surviving IOM reports false critical temperatures

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved a security vulnerability where a NULL pointer dereference could cause a system crash during boot if an internal memory allocation failed during the ExitBootServices or boot option launch sequence.

Addressed an issue where the Minimum Processor Idle Power Core C-State and Minimum Processor Idle Power Package C-State options were not appearing in System Configuration (RBSU) under Power and Performance Options on ML30 Gen10 and DL20 Gen10 platforms.

Known Issues:

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 05.01.05.103.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Mitigates CVE-2024-38798 through an EDK2 fix that clears password keystroke buffers after entry to avoid potential information disclosure.

Addressed ESKM key generation/shortening issue to prevent SED unlock failures by validating/regenerating malformed keys.

Fixed Power Calibration retry handling bug that could prevent expected power calibration behavior when requested by iLO.

Known Issues:

None

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where system encounter a Red Screen of Death(RSOD) when booting Windows Server 2022 after the Microsoft Windows Production PCA 2011 certificate had been removed from the Secure Boot DB.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

The Secure Boot dbx has been updated for CVE-2025-47827. Updating the System ROM alone will not update the Secure Boot dbx. Users must reset dbx to default, load manufacturing defaults, or enroll the updated dbx from Windows, Linux, RBSU, or Redfish directly. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 04.01.05.201.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM failed Secure Boot certificate validation, preventing the system from binding a driver to the NVMe controller.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed a potential system stability issue during boot caused by a NULL pointer dereference in the event logging code path when a memory allocation failure occurred.

Addressed the following security vulnerabilities: - CVE-2026-7383 (OpenSSL) - CVE-2026-33416 (Libpng) - CVE-2026-34757 (Libpng) - CVE-2014-9485 (MiniZip)

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

SPDM - Get Certificate response returns out of bound values

SPDM - Get Certificate response returns out of bound values

• The Enabled-ClusterS2D command now completes successfully when executed on a SATA drive within a D3610 disk enclosure for a NonStop solution.

• The smart carrier, which is the drive case for SAS drives, now authenticates in the D3610/D3710 drive enclosure.

• Added new 7-segment error codes E0 and E1 to report issues with Fan modules A and B, respectively. These new codes only apply to the D3610/D3710 and only display when running firmware 5.04.

• If the storage enclosure processor within the I/O module fails, a hard reset (power down and then power up) is executed to ensure the processor comes back online.

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

• Smart Array reporting "Storage Enclosure FW upgrade Problem Detected".
• PSU version is showing as "No Ver" after inserted the New bel power PSU.
• GEM_5_2 Coverity defect fix.

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

• Smart Array reporting "Storage Enclosure FW upgrade Problem Detected".
• PSU version is showing as "No Ver" after inserted the New bel power PSU.
• GEM_5_2 Coverity defect fix.

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM failed Secure Boot certificate validation, preventing the system from binding a driver to the NVMe controller.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed a potential system stability issue during boot caused by a NULL pointer dereference in the event logging code path when a memory allocation failure occurred.

Addressed the following security vulnerabilities: - CVE-2026-7383 (OpenSSL) - CVE-2026-33416 (Libpng) - CVE-2026-34757 (Libpng) - CVE-2014-9485 (MiniZip)

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

SFP Parameters value decimal part is truncated

SFP Parameters value decimal part is truncated

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

• Enabling DIM led to high IRQ/s in certain scenarios.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved potential system stability issues related to buffer validation in hardware error handling routines during System Management Mode operations on different-socket (Rome) configurations.

Known Issues:

Ver. 1.0.0.22(F) contains updates to the firmware packaging and is functionally equivalent to ver. 1.0.0.22. It is not necessary to upgrade with Revision F if a previous component revision was used to upgrade the firmware to version 1.0.0.22.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where Innovation Engine (IE) may improperly reset every 24 hours.

Known Issues:

None

Ver. 1.0.0.22(C) contains updates to the firmware packaging and is functionally equivalent to ver. 1.0.0.22. It is not necessary to upgrade with Revision C if a previous component revision was used to upgrade the firmware to version 1.0.0.22.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where Innovation Engine (IE) may improperly reset every 24 hours.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where system encounter a Red Screen of Death(RSOD) when booting Windows Server 2022 after the Microsoft Windows Production PCA 2011 certificate had been removed from the Secure Boot DB.

Known Issues:

This version of the System ROM contains updates aligned with the Intel Purley IPU2026.3 update.

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 04.01.05.312.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where the embedded diagnostic tool could fail to communicate with the internal REST client interface due to a parameter compatibility difference between Gen10 and Gen10 Plus platforms.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed an issue where the Advanced Memory Test could fail to re-enable memory self-refresh after a test pause, potentially causing memory test failures or unexpected results during extended memory diagnostics.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM fails Secure Boot certificate validation due to the transition from the Microsoft UEFI CA 2011 to the CA 2023 certificate.

Addressed an issue where SATA hard drive firmware updates could fail with a timeout error on certain drive models (Micron 5400 series) when the firmware image size is not an exact multiple of 4096 bytes, leaving the drive on its original firmware version.

Addressed an issue where One Button Secure Erase (OBSE) could hang indefinitely on systems with an embedded HPE Smart Array E208i-a SR Gen10 controller when drives are present, requiring physical drive removal to recover.

Addressed a potential system stability issue where a NULL pointer dereference could occur during boot if memory allocation fails in certain event logging code paths.

Known Issues:

• Enabling DIM led to high IRQ/s in certain scenarios.

•  SN1610Q and SN1700Q Adapter disappears from integrated Lights Out (ILO) listing when its Small Form Factor Pluggable (SFP) transceiver is reinserted.
• Vendor and Part Number Values are empty for Adapter port with 32G Amphenol Small Form Factor Pluggable (SFP) transceiver during Redfish SFP Read
• SN1610Q adapter with FW 02.11.09 configured on RedHat Enterprise Linux; rhel messages file is filled with the following kernel messages like: “qla2xxx [0000:61:00.0]-706d:4: Unable to read SFP data (2/a0/0)”
• HPE Firmware Flash for QLogic 32Gb and 64Gb Fibre Channel Host components doesn’t complete the firmware flash.
• HPE MBX CMD timeout and ISP Abort/Reset after SFP reinsertion.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where Secure Boot key auto-enrollment was not triggered after using "Reset all keys to platform defaults" in RBSU on systems with OEM Secure Boot customization, leaving the system without the expected default keys after reset.

Addressed an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Addressed an issue where NVMe drives could fail to boot when the NVMe OptionROM failed Secure Boot certificate validation, preventing the system from binding a driver to the NVMe controller.

Addressed a security vulnerability (CVE-2026-20712) related to Memory Overwrite Request (MOR) handling during boot where the MOR variable may not have been checked under certain platform configurations.

Addressed a potential system stability issue during boot caused by a NULL pointer dereference in the event logging code path when a memory allocation failure occurred.

Addressed the following security vulnerabilities: - CVE-2026-7383 (OpenSSL) - CVE-2026-33416 (Libpng) - CVE-2026-34757 (Libpng) - CVE-2014-9485 (MiniZip)

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where ESKM (Enterprise Secure Key Manager) server keys could be generated with invalid bytes, potentially causing Self-Encrypting Drive (SED) unlock failures. Keys are now validated upon generation and corrected during drive unlock operations if previously affected.

Known Issues:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

•  SN1610Q and SN1700Q Adapter disappears from integrated Lights Out (ILO) listing when its Small Form Factor Pluggable (SFP) transceiver is reinserted.
• Vendor and Part Number Values are empty for Adapter port with 32G Amphenol Small Form Factor Pluggable (SFP) transceiver during Redfish SFP Read
• SN1610Q adapter with FW 02.11.09 configured on RedHat Enterprise Linux; rhel messages file is filled with the following kernel messages like: “qla2xxx [0000:61:00.0]-706d:4: Unable to read SFP data (2/a0/0)”
• HPE Firmware Flash for QLogic 32Gb and 64Gb Fibre Channel Host components doesn’t complete the firmware flash.
• HPE MBX CMD timeout and ISP Abort/Reset after SFP reinsertion.

Garbled characters are observed in the System Utilities(F9) configuration screens with Japanese Environment when HPE Emulex Fibre Channel Host Bus Adapter is installed on ProLiant Gen11 and ProLiant Gen12 servers, applicable for:

• HPE SN1610E 32Gb Dual port Fibre Channel Host Bus Adapter
• HPE SN1610E 32Gb Single port Fibre Channel Host Bus Adapter
• HPE SN1700E 64Gb Dual Port Fibre Channel Host Bus Adapter
• HPE SN1700E 64Gb Single Port Fibre Channel Host Bus Adapter

SPDM - Get Certificate response returns out of bound values

No fixes are included in version 16.35.8008.

The following issues have been fixed in version 16.35.8002:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved potential system stability issues related to buffer validation in hardware error handling routines during System Management Mode operations on different-socket (Rome) configurations.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.