An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26 9.30 and 9.40 allows remote users to delete arbitrary files via servlet directory traversal.