What is the CVSS score of CVE-2026-79860?

CVE-2026-79860 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-79860?

Within 24 hours, inventory all HPE networking equipment and identify which devices may be affected; restrict network access to management interfaces using firewall rules and segment sensitive network segments; monitor for anomalous activity and review HPE bulletin hpesbnw05162en_us for interim guidance. Within 7 days, apply any vendor-recommended mitigations such as disabling unnecessary services or enabling enhanced logging; prioritize protection of internet-facing devices; engage HPE support for update timelines. Within 30 days, test and deploy patches as soon as they are released; conduct a security assessment of network architecture to reduce exposure; update incident response plans to address potential exploitation.

HPE Networking CVE-2026-79860

EUVD-2026-108360 CRITICAL

2026-10-22 security-alert@hpe.com

GHSA-hrxh-pm8h-2j3h

Information Disclosure

9.8

CVSS 3.1 · Vendor: hpe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach product over network (AV:N)
Exploit

Send crafted unauthenticated request
Execution

Trigger vulnerability (no auth, no UI)
Impact

Compromise confidentiality, integrity, and availability

Vulnerability Assessment

Exploitation Conditions	Per the CVSS vector alone (AV:N/AC:L/PR:N/UI:N), exploitation would require only network reachability to the affected HPE networking product with no authentication and no user interaction. However, no description is available to name the exact product feature, protocol, service, or configuration that must be exposed or enabled, so the real limiting factors cannot be stated with confidence. Defenders should consult HPE bulletin hpesbnw05162en_us to determine the specific product, affected versions, exposed interface, and any non-default configuration required.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a maximally severe network-reachable, unauthenticated flaw with full confidentiality, integrity, and availability impact. The vuln.today decision label is 'act_now', signaling top-tier prioritization. However, the supporting evidence is thin and partly conflicting: there is NO description, NO CWE, NO EPSS score, NO CISA KEV listing, and NO PoC/exploit reference in the input, so there is no public exploit identified at time of analysis. A notable conflict exists between the single tag 'Information Disclosure' (which implies a confidentiality-only impact) and the CVSS vector's I:H and A:H (which claim full integrity and availability impact as well) - these cannot both be fully correct, and the discrepancy should be resolved against the HPE bulletin. Net assessment: treat as a high-priority patching item per the vendor and the act_now label, but recognize the risk rating rests almost entirely on an unverified CVSS vector and a vendor-reported entry rather than corroborated exploitation data. Verify affected product and impact scope directly against HPE bulletin hpesbnw05162en_us before drawing firm conclusions.
Exploit ScenarioDerived	Based solely on the CVSS vector, a remote attacker with no credentials and no user interaction reaches the affected HPE networking product over the network and sends crafted input to trigger the flaw, gaining access to sensitive data and/or compromising the device. No PoC or exploit reference is provided in the input, and the exact trigger is not described in the available sources, so the concrete mechanism cannot be detailed.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 22, 2026

HPE networking equipment is affected by a CVE with no published description, but its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes unauthenticated network-reachable access with high confidentiality, integrity, and availability impact. The supplied tag says Information Disclosure, while the vector indicates broader impact; the affected feature, protocol, and exact models are not identified in the available data. No public exploit was identified at time of analysis; HPE bulletin hpesbnw05162en_us is the only remediation reference, and the vuln.today decision is act_now.

RemediationAI

No vendor-released patch version is identified in the supplied data; the only remediation source is HPE bulletin hpesbnw05162en_us, which must be consulted to determine the fixed firmware/software release and any product-specific workaround. Because the affected interface and configuration are not named, no specific port, service, or endpoint can be safely recommended for blocking; defenders should first confirm from the bulletin whether their deployed HPE networking product is in scope. If it is, isolate the device from untrusted network access until the HPE-specified fixed release can be applied, accepting that isolation may disrupt management or production traffic, and monitor the HPE advisory for updates.

Affected VersionsENISA

Unknown product 8.12.0.0 ≤8.13.3.0

Unknown product 8.10.0.0 ≤8.10.0.23

Affected Packages

euvd unknown_product no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root-cause class is not stated: CWE is N/A and no description was provided, so the trigger is not described in the available sources. The CVSS vector only establishes severity and prerequisites-network reachability, low attack complexity, no privileges, and no user interaction-not the underlying mechanism. No CPE data was supplied, so exact HPE models, firmware branches, and exposed services remain unidentified; the Information Disclosure tag is the only impact-class hint, but it conflicts with the vector's high integrity and availability ratings and should not be used to infer a specific flaw type. The referenced HPE bulletin hpesbnw05162en_us must be used to map the CVE to a product and configuration.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hpe) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

No description provided

Executive ViewAI

Why It Matters

Critical unauthenticated network-reachable vulnerability in HPE networking equipment (CVE-2026-79860) with potential to compromise confidentiality, integrity, and availability. No patch is available and no public exploit has been identified, but the severity demands immediate leadership attention. Attackers could disrupt or gain access to network infrastructure, affecting all connected services and data.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to affected devices via firewall rules, segment network to limit lateral movement, monitor logs for suspicious activity, and follow HPE bulletin hpesbnw05162en_us for additional guidance.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Medium

HPE networking bulletin; enterprise gear but exact product unconfirmed

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS NCSC-NL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.