HPE Networking CVE-2026-95716

Exploitation requires the attacker to be on the same adjacent network as the affected HPE networking device (AV:A) - e.g. the same Layer-2 broadcast domain, VLAN, or local segment - which means it is NOT exploitable directly from the internet and the adjacency requirement is the primary limiting factor. Within that segment, no authentication (PR:N) and no user interaction (UI:N) are needed, and complexity is low (AC:L). No specific feature, protocol, or non-default configuration prerequisite can be named because no CVE description was provided; the exact trigger is not described in the available sources. The affected product and versions are not specified in the input and must be confirmed from the HPE advisory (docId hpesbnw05162en_us).

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N: exploitation requires adjacent-network access (AV:A) - the attacker must sit on the same local/logical network segment, not reach the device across the open internet - but needs no privileges (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L). Impact is integrity-only (I:H) with no confidentiality (C:N) and no availability (A:N) effect. The input provides no EPSS score, no CISA KEV listing, and no POC/exploit reference, so there is no public exploit identified at time of analysis and no quantified exploitation probability to compare against the severity. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent item: patch on a normal cycle, prioritized by the adjacent-network reachability of affected HPE networking devices. One signal conflict must be flagged: the only tag is 'Information Disclosure' (which implies a confidentiality impact), yet the CVSS vector records C:N/I:H (integrity, not confidentiality) - these are inconsistent and, with no description provided, the true impact cannot be confirmed; verify the actual effect against the HPE advisory.

An attacker positioned on the same local network segment as the affected HPE networking device sends crafted, unauthenticated traffic that the device processes without requiring credentials or user interaction, allowing the attacker to alter or inject data (integrity impact). Because the vector is Adjacent (AV:A), the attacker first needs a foothold on the local/broadcast network - e.g. a compromised host or physical/VLAN access - rather than direct internet reach. No public exploit code or PoC reference is present in the supplied data.