HPE Networking CVE-2026-79895

Per the CVSS vector the flaw is remotely reachable and requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), so exploitation needs only network access to an affected HPE networking device. However, no CVE description or advisory text was provided, so the trigger is not described in the available sources - the specific feature, protocol, port, or configuration that must be reachable cannot be named from this data. The primary limiting factor is network exposure: devices not reachable by the attacker (segmented/management-plane-only, firewalled) are not exploitable, and impact is confined to availability (service disruption/DoS), with no confidentiality or integrity loss indicated. Confirm affected models, versions, and any mode-specific preconditions against HPE bulletin hpesbnw05162en_us.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is availability (A:H) with no confidentiality or integrity impact - i.e. a denial-of-service condition, not data exposure. This directly contradicts the single input Tag 'Information Disclosure', which implies a confidentiality impact the vector explicitly rates as C:N; the tag should be treated as suspect and verified against the HPE advisory. No EPSS score, no CISA KEV listing, and no SSVC exploitation/automatable/technical-impact values were supplied, so exploitation likelihood cannot be quantified from the data. There is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_week', indicating prompt but non-emergency remediation; this is consistent with a network-reachable high-availability-impact issue that currently lacks evidence of active exploitation. Net read: a legitimate patch-this-cycle item for affected HPE networking deployments, but not a drop-everything emergency on present evidence - reassess if the HPE advisory or a later KEV entry indicates exploitation.

A remote, unauthenticated attacker with network reachability to an affected HPE networking device sends crafted traffic that the device mishandles, exhausting resources or crashing the service and denying availability to legitimate users. No public exploit code is identified at time of analysis, and the exact trigger is not described in the available sources. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required to reach the condition.