HPE Networking CVE-2026-79855

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions beyond network reachability of the affected HPE networking product: remote, unauthenticated, no user interaction against a reachable instance. However, no CVE description was provided, so the exact vulnerable feature, protocol, service, configuration mode or affected versions that must be present are not described in the available sources and should be confirmed from the HPE bulletin (hpesbnw05162en_us). The main limiting factor is network exposure of the affected service; whether a non-default configuration or specific product version is required cannot be determined from the supplied data. The 'Information Disclosure' tag may indicate the impact is narrower than the full-CIA CVSS vector suggests - unverified.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with full compromise of confidentiality, integrity and availability - the maximum-severity profile. The vuln.today decision label is act_now, which reinforces treating this as a high-priority item. However, the signals are incomplete and partly conflicting: no EPSS score is provided, the CVE is not noted as present in CISA KEV, and no PoC or exploit reference is supplied, so there is currently no public exploit identified at time of analysis and no quantified exploitation probability. There is also an internal conflict: the sole tag is 'Information Disclosure', which normally implies a confidentiality-only impact, yet the CVSS vector asserts I:H and A:H as well - these cannot both be literally true, so either the tag understates the impact or the CVSS impact metrics are overstated; this must be verified against the HPE bulletin. No CVE description was provided and the only reference (an HPE networking security bulletin) could not be retrieved in this analysis, so the affected product, vulnerable component and trigger are not confirmed. Net: the severity metrics and act_now label justify prioritizing remediation, but the missing description and tag/CVSS conflict mean the true scope should be confirmed against the HPE advisory before firm conclusions are drawn.

Per the CVSS vector, a remote attacker with network access to an affected HPE networking product sends a crafted request to the vulnerable service without needing credentials or user interaction, achieving high impact to confidentiality, integrity and availability. The specific vulnerable feature and the trigger are not described in the available sources. No public exploit code is identified at this time.