HPE CVE-2026-79851

The CVSS vector indicates remote, network-based exploitation requiring no authentication (PR:N) and no user interaction (UI:N) at low attack complexity, with a changed scope (S:C) implying impact can reach systems beyond the vulnerable component. However, NO description or CWE was provided, so the specific product feature, protocol, configuration setting or deployment mode that must be present cannot be extracted from the available sources - the exact prerequisite is not described. Limiting factors therefore cannot be confirmed: whether a particular HPE networking service, management interface, or non-default mode must be exposed is unverified and should be read directly from HPE bulletin hpesbnw05162en_us before scoping exposure.

The signals point in a serious but incompletely corroborated direction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 10.0) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, with a changed scope and high impact to confidentiality, integrity and availability - the most severe possible profile. The vuln.today decision label is act_now, which aligns with that severity and argues for immediate remediation. However, several corroborating signals are ABSENT from the supplied data: no EPSS probability is provided, there is no CISA KEV listing, and no PoC or exploit reference appears among the references - only the HPE vendor advisory. Treat exploitation as 'no public exploit identified at time of analysis' rather than active. There is also a conflict to flag: the single tag is 'Information Disclosure', yet the CVSS vector asserts high Integrity AND Availability impact plus a scope change, which is far broader than pure information disclosure - the tag likely understates the flaw, or the vector is generically maximal; verify with the HPE bulletin. Critically, NO description and NO CWE are provided, so the mechanism is unknown. Net: this should be treated as a real high priority on the strength of the vendor act_now label and critical vector, but the lack of EPSS/KEV/PoC means urgency rests on vendor severity rather than demonstrated in-the-wild exploitation.

Per the CVSS vector, a remote attacker with network reachability to the affected HPE networking product sends crafted traffic to the exposed service and exploits the flaw without authentication or user interaction, gaining high impact to confidentiality, integrity and availability; the changed scope (S:C) means the compromise can extend beyond the vulnerable component to adjacent systems. The precise trigger is not described in the available sources (no description or CWE was provided). No public exploit or PoC reference is present in the supplied data.