HPE Networking Devices CVE-2026-79878

Exploitation requires network adjacency (CVSS AV:A): the attacker must reach the HPE networking device from the same logical/adjacent network - e.g., the same LAN segment, VLAN, Wi-Fi network, or a dedicated management network - not arbitrary internet-wide access, which is the primary limiting factor. Within that position, the attack needs no authentication (PR:N) and no user interaction (UI:N), and is low-complexity (AC:L). The exact product feature, protocol, or configuration that triggers the flaw is not described in the available sources (no CVE description was provided); the specific affected HPE networking product, versions, and any non-default configuration dependency should be confirmed directly from HPE bulletin hpesbnw05162en_us.

The CVSS 3.1 vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes a low-complexity, unauthenticated attack from an adjacent network position yielding high confidentiality, integrity, and availability impact. The vuln.today decision label is 'this_week', indicating elevated but not emergency priority. Key corroborating signals are absent: no EPSS probability, no CISA KEV listing, and no public PoC or exploit reference are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a conflict between signals: the only tag is 'Information Disclosure', yet the CVSS vector asserts HIGH integrity and availability impact (I:H/A:H) in addition to confidentiality - the tag understates the stated impact, so the true nature of the flaw cannot be confirmed from the tag alone and should be verified against the HPE advisory. The AV:A (adjacent) vector is a meaningful limiter versus a fully remote AV:N issue: exploitation requires a foothold on the same logical network segment (e.g., same LAN/VLAN or wireless/management network) rather than arbitrary internet reachability, which reduces mass-exploitation potential and points toward an attacker already inside the network perimeter. Overall this is a genuine high-severity issue warranting prompt patching per the 'this_week' label, but the adjacency requirement and absence of EPSS/KEV/PoC signals argue against treating it as an active, widespread emergency.

An attacker who has gained a position on the same adjacent network segment as a vulnerable HPE networking device (for example, a compromised host on the same VLAN or management network) sends crafted traffic to the device without needing credentials or user interaction. Per the CVSS vector (AV:A/AC:L/PR:N/UI:N), the low-complexity, unauthenticated nature means a single reliable interaction could compromise the device's confidentiality, integrity, and availability. The specific trigger mechanism is not described in the available sources, and no public exploit code has been identified.