HPE Networking EUVD-2026-108345

The specific prerequisites (required feature, protocol, configuration mode, or affected service) are not described in the available sources, because no CVE description or advisory text was provided. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based, low-complexity, and requires neither authentication nor user interaction, which would imply reachability of the affected HPE networking interface is the only gating factor; however this cannot be confirmed against a vendor description, and the exact affected product, versions, and whether default configurations are vulnerable remain unverified. Limiting factors therefore cannot be enumerated from the available data beyond network reachability to the affected component.

Signals are strongly divergent and partly unverifiable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scores 10.0 and describes a network-reachable, low-complexity, unauthenticated flaw with a changed scope and high confidentiality AND integrity impact - a textbook critical rating. The vuln.today decision label is 'act_now', which aligns with that severity and argues for urgent remediation. However, the only descriptive signal, the 'Information Disclosure' tag, implies a confidentiality-only issue, which conflicts with the I:H in the vector - this contradiction cannot be resolved without the vendor advisory text, which was not available. No description, CWE (N/A), EPSS score, SSVC automatable/technical-impact breakdown, or KEV listing was provided, and no PoC or exploit reference is present (the sole reference is the HPE bulletin itself). So there is no evidence of active exploitation and no exploitation-probability data to temper or confirm the high CVSS. Net: treat as a high-priority item consistent with the 'act_now' label and a 10.0 unauthenticated-remote vector, but verify the actual impact (pure disclosure vs. disclosure+integrity) and affected product/versions directly against HPE bulletin hpesbnw05162en_us before acting, because the impact metrics and the sole tag disagree.

A remote attacker with network reach to the affected HPE networking product sends crafted traffic to the vulnerable interface and, without authentication or user interaction, obtains sensitive information that crosses a trust boundary (scope change). The precise trigger is not described in the available sources. No public exploit or PoC reference was provided, so exploitation would currently require attacker-developed tooling.