HPE Device CVE-2026-79865

Exploitation requires the attacker to be on a network adjacent to the affected HPE device (AV:A) - the same broadcast/L2 segment, VLAN, or wireless network - rather than anywhere routable on the internet; it does not require authentication (PR:N), user interaction (UI:N), or elevated privileges, and complexity is low (AC:L). This network-adjacency requirement is the principal limiting factor and means a remote internet attacker cannot reach it directly without first obtaining local network access. The exact triggering feature, protocol, protocol setting, or deployment mode is not described in the available sources, because no CVE description was provided; consult the HPE advisory (hpesbnw05162en_us) to identify the specific affected product, service, and any non-default configuration involved.

This is scored CVSS 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and carries a vuln.today Decision label of act_now, so it should be treated as a top-priority patch item, not a high-CVSS-but-low-risk issue. The vector is favorable to an attacker in most respects - low complexity (AC:L), no privileges (PR:N, i.e. unauthenticated), no user interaction (UI:N), a scope change (S:C), and full confidentiality, integrity and availability impact (C:H/I:H/A:H). The one mitigating factor is the attack vector: AV:A (Adjacent) means the attacker must be on the same adjacent/local network (e.g. the same L2 segment, VLAN, or Wi-Fi) rather than anywhere on the internet, so this is not an AV:N mass-internet-exploitable flaw and is better characterized as a targeted or post-foothold threat than a wormable one. Signals conflict and some are simply absent: no EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so the act_now urgency here is driven by the vendor's CVSS severity and scope change rather than by any confirmed exploitation evidence. There is also an internal tension between the 'Information Disclosure' tag (confidentiality-oriented) and the CVSS claim of I:H and A:H - verify the true impact set against the HPE advisory. Finally, no description, CWE, affected products, or fixed versions were supplied in the input, so the mechanism and exact affected product cannot be confirmed from the data given.

An unauthenticated attacker who has gained a position on the same adjacent network as the affected HPE networking device (for example, a connected VLAN or wireless segment) sends crafted traffic to it. Because the flaw requires no privileges or user interaction and has a scope change, successful exploitation can compromise confidentiality, integrity and availability beyond the vulnerable component itself. No public exploit identified at time of analysis; the single reference is an HPE vendor advisory, not proof-of-concept code.