CVE-2025-10568 is a critical code execution flaw (CVSS 9.8) in HyperX NGENUITY software. HP is releasing updated software to address it. The record gives no version number, so install the latest NGENUITY release from HP and read bulletin HPSBHF04050 for the exact fixed build.
What's affected
The record lists HyperX NGENUITY software as affected. It is the companion application for HyperX gaming peripherals on Windows. The record gives no affected version range.
HP, which publishes the bulletin, says it is releasing updated software. I could not read the bulletin text, so I cannot name the first fixed build. Check HP security bulletin HPSBHF04050 for it.
How to check if you're exposed
On the Windows machine, open Settings, then Apps, and look for HyperX NGENUITY. Note the version number. Compare it with the fixed version in HP bulletin HPSBHF04050.
If you manage many machines, query your endpoint management tool for the installed application name and list every host that has it. Gaming peripherals on corporate laptops are easy to miss in an inventory.
What to do now
- Install the latest HyperX NGENUITY release from HP, and confirm the version against bulletin HPSBHF04050.
- If you do not use the software, uninstall it.
- Add NGENUITY to your endpoint inventory so future bulletins are easy to match.
- Keep standard user accounts for daily work, to limit what any code execution bug can reach.
Why it matters
This is CWE-78, OS command injection. The software builds an operating system command from input that is not properly neutralized. The record scores it 9.8 with network access, no privileges and no user interaction, though HP's one line description says only that code execution is potentially possible.
Peripheral utilities often run with elevated rights or start at boot, which raises the cost of a bug. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
Planning for software with no vendor fix
When no patched version is named, you have three options: fix it yourself, shield it, or retire it. Fixing it yourself works well for small PHP applications, since the change is usually one query. Shielding means network controls and a firewall rule. Retiring means moving to a maintained alternative.
Whichever you choose, write the decision down with an owner and a review date. Unpatched software tends to be forgotten rather than decided on. Continuous monitoring of your inventory against new advisories makes sure a fix, if one appears later, does not slip past you.
How scoring and records can mislead
A CVSS score is a starting point. It describes the flaw in general, not your deployment. Two things can move your real risk in either direction: whether the vulnerable component is reachable from where attackers sit, and what the process can touch once compromised.
Also keep in mind that records for newly published CVEs are often thin. Some state a vendor name and a file and little else. When the advisory is short, rely on your own inventory and on defensive basics, and revisit the record as details are added.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
HP says updated software is being released. The record gives no number, so use bulletin HPSBHF04050.
Is it exploited in the wild?
The record does not flag it as a CISA KEV entry, and I found no source that says so.
Sources
- Safeguard Gold entry for CVE-2025-10568
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://support.hp.com/us-en/document/ish_13012432-13012454-16/hpsbhf04050
Last reviewed: 19 October 2026.
