EUVD-2026-108350
GHSA-3p2w-qx6f-5qxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed HPE service
-
ExploitSend crafted unauthenticated request
-
ExecutionExploit flaw crossing trust boundary
-
ImpactDisclose sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no special conditions - remote, unauthenticated exploitation with no user interaction against a network-reachable HPE networking service. However, no description, affected product, version, or configuration detail is provided, so the exact feature, protocol, or deployment mode that must be exposed cannot be named from the available sources and must be confirmed against HPE bulletin hpesbnw05162en_us. The only inferable limiting factor is network reachability of the affected service; whether a non-default configuration or specific platform is required is not stated in the evidence. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scores 10.0 - the maximum - indicating a remotely reachable flaw requiring no authentication, no user interaction, and low attack complexity, with a scope change that lets impact cross the vulnerable component's security boundary and high confidentiality and integrity loss. The vuln.today decision label is act_now, which is consistent with a network-facing, unauthenticated critical in an HPE networking product and should drive emergency patching urgency. However, the signal set is thin and partly contradictory: there is no description, no CWE, no EPSS probability, no CISA KEV entry, and no PoC or exploit reference in the input, so there is no public exploit identified at time of analysis and no data-driven estimate of exploitation likelihood - the 10.0/act_now rating rests on severity, not on observed exploitation. There is also an internal tension: the single tag is 'Information Disclosure' (a confidentiality concern), yet the vector asserts I:H (high integrity impact) and S:C (scope change); the tag and the vector disagree on whether integrity is actually affected, and with no description this cannot be resolved from the available data - verify against the HPE advisory. Net: treat as a high-priority patch item on the strength of the maximal CVSS and the act_now label, while recognizing that exploitation probability is unquantified and the precise impact (info-disclosure-only vs. integrity-affecting) is unconfirmed. |
| Exploit ScenarioDerived | Per the CVSS vector, a remote attacker with no credentials and no user interaction sends traffic to a network-exposed HPE networking service and triggers the flaw, gaining high confidentiality (and, per the vector, integrity) impact that crosses a security boundary (S:C). The mechanism is not described in the available sources, so the exact request or protocol cannot be specified. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
HPE's security bulletin hpesbnw05162en_us covers a maximum-severity flaw (CVSS 3.1 base score 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) in an HPE networking product that remote, unauthenticated attackers can reach with no user interaction and low attack complexity; the scope-change metric means the impact can cross the vulnerable component's security boundary, with high confidentiality and integrity loss and no availability impact scored. The exact product, version range and exposed feature are absent from the available intelligence - no CPE, no CWE and no description were supplied - so the affected deployment must be identified from the HPE advisory itself. No public exploit identified at time of analysis: there is no CISA KEV entry and no PoC or exploit reference in the supplied data, while the vuln.today priority decision is act_now and the report originates from HPE's own security-alert mailbox.
RemediationAI
No vendor-released patch, fixed version or workaround is identified in the supplied data, so remediation must be driven directly from HPE Security Bulletin hpesbnw05162en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US), which should be consulted for the exact affected product list, the fixed firmware or software release per branch, and any configuration-level mitigation HPE recommends; because the priority decision is act_now and the vector is unauthenticated over the network, locating the patched release and applying it should be treated as the primary action rather than a deferred one. The only limiting factor that can be inferred from the evidence is network reachability of the affected service, so pending the vendor's fixed build, reducing which networks, users and management segments can reach the HPE networking service is the single inference-supported compensating control; its trade-off is loss of legitimate management or operational access from the restricted paths, and it should not be described as a complete fix. No other mitigation - such as disabling a named feature, blocking a specific port, or tightening a specific endpoint - can be recommended responsibly here, because the available sources do not identify the vulnerable feature or protocol; do not assume a given interface is safe or unsafe until the bulletin confirms it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only technical anchors are the CVSS 3.1 vector and the single vendor reference. AV:N places the attack path over the network, AC:L indicates no special attack conditions are recorded, PR:N and UI:N mean no credentials and no victim interaction are needed per the vector, and S:C indicates the scored impact extends beyond the vulnerable component's own security authority into other components. C:H and I:H reflect full loss of confidentiality and integrity as scored; A:N means availability impact was not scored, although the vector does not by itself say whether that reflects a design property or a scoping decision. Scope change plus high confidentiality/integrity is characteristic of flaws where an exposed service can be leveraged against the surrounding system or its data, but the trigger, the vulnerable protocol or feature, the deployment mode, and any configuration prerequisites are not described in the available sources and must be confirmed from HPE bulletin hpesbnw05162en_us. One inconsistency is worth flagging for triage: the source tag reads "Information Disclosure", which would normally map to a confidentiality-only impact, yet the assessed vector scores integrity as high as well, so the practical effect should be treated as broader than disclosure until the vendor text is reviewed. No CWE identifier was assigned in the supplied data, so the root-cause class (for example injection, authentication bypass, or memory-safety) cannot be stated, and no CPE strings were provided to pin the affected product or version line.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
No description is available, so the metrics necessarily mirror the vendor-supplied vector; AV:N/PR:N/UI:N reflect remote unauthenticated reach and S:C the stated cross-boundary impact, though I:H is unverified against the 'Information Disclosure' tag.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Executive ViewAI
A critical vulnerability in an unspecified HPE networking product (CVE-2026-79850) poses a maximum-severity risk (CVSS 10.0) to our network infrastructure, potentially allowing unauthenticated remote attackers to compromise confidentiality and integrity across security boundaries. While no public exploit has been identified, the lack of a patch and the product's network exposure necessitate immediate leadership action to identify affected systems, assess exposure, and enforce compensating controls to prevent potential breaches.
No vendor-released patch identified at time of analysis; interim mitigations include network segmentation to limit exposure, strict firewall rules to restrict access to affected devices, and monitoring for signs of exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB