HPE Networking CVE-2026-79879

Exploitation requires the attacker to be on the network adjacent to the affected HPE networking device (CVSS AV:A - same broadcast/L2 domain or logically adjacent network, not the open internet); this adjacency requirement is the primary limiting factor and prevents direct internet-based attacks. Within that network position, no authentication (PR:N), no user interaction (UI:N), and only low attack complexity (AC:L) are needed against the device. The exact affected product, feature, protocol, configuration mode, and software versions are not stated in the available data (no description or advisory text provided), so the specific functional prerequisite cannot be named - consult HPE advisory hpesbnw05162en_us to identify the affected product and any configuration or version conditions.

The CVSS 3.1 base score is 8.8 (High) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker on the adjacent network (same L2 segment / logically adjacent, NOT the full internet) can achieve high impact to confidentiality, integrity, and availability with low complexity and no user interaction. The AV:A constraint is the single most important risk-reducing signal: exploitation requires a foothold on the local network segment of the affected HPE networking device, so this is not remotely internet-exploitable and real-world risk is gated by network position. No EPSS score, CISA KEV listing, SSVC automatable/technical-impact values, or POC/exploit reference is present in the input, so exploitation likelihood cannot be quantified from the data provided - the only prioritization signal is the vuln.today Decision label 'this_week', which indicates meaningful urgency but is below act_now/emergency. CONFLICT TO VERIFY: the sole tag is 'Information Disclosure', yet the CVSS vector asserts I:H and A:H (full integrity and availability compromise, not just disclosure) - the impact profile is broader than the tag implies; the HPE advisory should be consulted to confirm actual impact. Overall this is a genuinely high-severity networking flaw whose practical exploitability depends on adjacent-network access rather than widespread internet-facing exposure.

An attacker who has gained a position on the same network segment as a vulnerable HPE networking device (e.g., via a compromised host, rogue device, or wireless foothold) sends crafted traffic to the device and, without credentials or user interaction, compromises its confidentiality, integrity, and availability. Because AC is low and no authentication is required, exploitation is straightforward for anyone with adjacent-network access. No public exploit identified at time of analysis, and the precise trigger is not described in the available sources.