EUVD-2026-108385
GHSA-v497-5qvg-gwqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach affected HPE service over network
-
ExploitSend crafted malicious request
-
ExecutionTrigger unspecified flaw in product
-
ImpactCause availability loss with limited integrity impact
Vulnerability Assessment
| Exploitation Conditions | The specific prerequisite feature, protocol, or configuration is not described in the available sources - no CVE description, affected product name, or version data was provided. The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated reachability against a default configuration of the affected HPE networking product, but the exact exploit trigger cannot be confirmed. Limiting factors that defenders should verify from the HPE bulletin: which specific product and versions are affected, whether the vulnerable service is network-exposed by default, and whether the impact is availability-only (consistent with C:N/I:L/A:H) rather than information disclosure as the tag suggests. |
| Impact | Severity signals are moderately high but thin. The supplied CVSS 3.1 base score is 8.2 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), which indicates a network-reachable, low-complexity flaw needing no privileges or user interaction, whose primary consequence is a high availability impact with only a limited integrity impact and NO confidentiality impact (C:N). This directly conflicts with the single tag 'Information Disclosure': a disclosure/confidentiality issue would normally show C:H or C:L, so either the tag or the vector is mislabeled - this should be verified against the HPE bulletin. No EPSS probability, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no evidence of active or imminent exploitation; the only forward-looking signal is the vuln.today 'this_week' decision label, which implies prompt (not emergency) remediation. On balance this reads as a credible network-exploitable denial-of-service-type issue worth patching on a near-term schedule rather than a confirmed, widely-exploited priority. No SSVC exploitation/automatable/technical-impact values were provided, and because no description or CWE was supplied, the mechanism of the flaw cannot be characterized from this data. |
| Exploit ScenarioDerived | Because the vector is AV:N/AC:L/PR:N/UI:N, a remote attacker with network access to the affected HPE networking product could send crafted traffic that the service mishandles, resulting in a high impact to availability (e.g., crash or service disruption) and a limited integrity effect. No public exploit or PoC reference is present in the input, and the exact trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
HPE networking products are affected by a remotely reachable, unauthenticated flaw rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:H), where the dominant risk is loss of availability with a limited integrity impact rather than the exposure of data. The single supplied source - HPE security bulletin hpesbnw05162en_us - is the only authoritative record of which platforms and firmware revisions are in scope, because no CVE description, CPE mapping, or version range was included in the intelligence feed. No public exploit code or PoC reference was identified at time of analysis, and the issue has not been added to CISA KEV; it carries a this_week priority label, so remediation should be scheduled within the current patching cycle rather than treated as an emergency.
RemediationAI
No fixed version is given anywhere in the supplied data, so a specific patched release cannot be cited; the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US is the authoritative source for the affected matrix and any fixed firmware, and it should be checked before any upgrade decision. No vendor workaround or mitigation guidance was included in the feed, and the trigger and vulnerable service are undescribed, so the safest interim position is to limit who can reach the device's remotely accessible interfaces - restrict management and service access to trusted administrative network ranges and remove any internet-facing exposure - accepting that this constrains legitimate remote administration and monitoring until a fixed firmware revision is confirmed and applied. Patch status remains: no vendor-released patch identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No CWE identifier was assigned in the available data, and the supplied sources do not describe how the flaw is triggered, so the underlying defect class and the vulnerable code path remain unverified. What the CVSS 3.1 vector does establish is the reachability profile: AV:N and AC:L indicate the attack surface is reachable over the network with no unusual preconditions, while PR:N and UI:N indicate it can be exercised by a remote party without credentials and without luring a user into an action. Scope is unchanged (S:U), so the compromise stays within the affected component. The impact triplet is the notable element: C:N/I:L/A:H means confidentiality impact is explicitly none, integrity impact is low, and availability impact is high - an availability-oriented outcome. This sits in direct tension with the sole intelligence tag, 'Information Disclosure', which would normally imply a confidentiality impact; defenders should treat the tag as unverified metadata and plan against the assessed vector. Because no CPE strings were supplied, the specific HPE product line, firmware branch, and whether the exposed service listens by default cannot be determined from the feed alone, and the HPE bulletin must be read to resolve those gaps.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
No description was provided, so metrics mirror the vendor-supplied vector: network-reachable, unauthenticated, availability-dominant impact with no confidentiality effect (C:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Executive ViewAI
HPE networking products contain a high-severity, unauthenticated flaw (CVE-2026-79885) that could enable remote attackers to disrupt network availability and compromise integrity. Leadership should prioritize this within the weekly patch cycle, as exploitation could degrade critical network services and operational continuity.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to affected devices, enabling logging and monitoring for anomalous activity, and following HPE's specific workarounds from bulletin hpesbnw05162en_us.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB