HPE Networking CVE-2026-79859

The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against a network-reachable HPE networking product, implying no special preconditions. However, this cannot be confirmed because no CVE description, affected-product name, configuration detail, or deployment-mode information was provided, and the HPE bulletin could not be retrieved. Therefore the concrete prerequisites (specific feature, protocol, port, or non-default setting) and any limiting factors are not described in the available sources; the only limiter evidenced is network reachability to the affected service. Authentication is unauthenticated per PR:N.

The input assigns CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): network-reachable, low-complexity, unauthenticated (PR:N) exploitation with high confidentiality, integrity AND availability impact. The vuln.today decision label is 'act_now,' and the issue was reported through HPE's PSIRT (security-alert@hpe.com) and published in an HPE networking security bulletin (hpesbnw05162en_us); together these signal vendor-driven urgency that, per the decision label, should be treated as an immediate priority. However, key corroborating signals are MISSING: no EPSS probability, no CISA KEV entry, and no PoC/exploit reference are supplied, so there is no public exploit identified at time of analysis and no independent exploitation-likelihood data behind the 'act_now' call - the urgency currently rests on the vendor advisory plus the critical CVSS, not on observed exploitation. There is also a direct conflict in the metadata: the sole tag 'Information Disclosure' implies confidentiality-only impact (which would be C:H/I:N/A:N), yet the supplied vector asserts full I:H/A:H as well; these cannot both be correct and must be reconciled against the HPE bulletin. Additionally, no description, no CWE, no affected-product name, and no fixed version are provided, so mechanism and scope cannot be verified from the available data. Net: handle as high priority consistent with the 'act_now' label and 9.8 score, while noting the rating is almost entirely vector/vendor-driven rather than exploitation-evidenced.

Per the CVSS vector, a remote, unauthenticated attacker with network access to the affected HPE networking product sends crafted traffic to the exposed service and, with low attack complexity and no user interaction, gains high impact to confidentiality, integrity, and availability. No PoC or exploit reference is provided, so no public exploit is identified at time of analysis. The specific trigger is not described in the available sources - no CVE description or CWE was supplied - so the exact mechanism cannot be stated.