HPE Networking CVE-2026-79871

Exploitation requires the attacker to be on an adjacent network to the affected HPE networking device (AV:A) - that is, the same Layer-2 segment, VLAN, or logically adjacent broadcast domain rather than the routable internet; this adjacency requirement is the primary limiting factor and means the device is not exploitable by arbitrary remote internet attackers. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so once network-adjacent the barrier is minimal. The specific product feature, protocol, or configuration that triggers the flaw is not described in the available sources (no description or CWE was provided), so the concrete prerequisite cannot be named beyond the adjacency requirement.

Signals point to a genuine high-priority issue, but with important caveats. The authoritative CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes an adjacent-network, low-complexity, unauthenticated, no-interaction flaw with a scope change and full confidentiality/integrity/availability impact - a severe profile for a networking product. The vuln.today decision label is 'act_now', reinforcing urgency. However, several key signals are MISSING: there is no EPSS score, no CISA KEV listing, and no POC/exploit reference in the input, so exploitation probability cannot be quantified and no active exploitation is confirmed. There is also a conflict between the single tag 'Information Disclosure' (which implies confidentiality-only impact) and the CVSS vector's C:H/I:H/A:H (full triad impact) - verify the true impact with the HPE advisory, as the tag appears to understate the vulnerability. Additionally, no description, CWE, or affected-version/product data was supplied, so the exact mechanism and footprint are unverified. Net assessment: treat as a real priority on the strength of the 9.6 adjacent/unauthenticated vector and the 'act_now' label, while recognizing that the absence of EPSS/KEV/POC means widespread or confirmed exploitation is NOT established - this reads as a high-severity flaw warranting prompt patching rather than evidence of in-the-wild attacks.

An attacker positioned on the same adjacent network segment as the affected HPE networking device (e.g., same LAN/VLAN or broadcast domain) sends crafted traffic to the device without any authentication or user interaction, and because the CVSS scope is changed, the impact extends beyond the vulnerable component to affect confidentiality, integrity, and availability. The precise trigger is not described in the available sources. No public exploit identified at time of analysis.