EUVD-2026-108353
GHSA-776w-cmh7-6vhx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed HPE network service
-
ExploitSend crafted unauthenticated request
-
ImpactFully compromise confidentiality, integrity, availability
Vulnerability Assessment
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no special conditions - remote, unauthenticated exploitation with no user interaction against a network-reachable HPE networking product. However, the CVE provides no description, so the exact feature, protocol, configuration setting, or deployment mode that must be present to trigger the flaw cannot be identified or confirmed from available sources. The only limiting factor derivable from the data is network reachability of the affected service; whether a non-default configuration, specific platform, or specific version is required is unverified pending the HPE advisory. |
| Impact | Signals conflict on urgency versus confirmed activity. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) indicates a remotely reachable, low-complexity flaw needing no privileges and no user interaction, with total loss of confidentiality, integrity and availability - the profile of a high-priority network vulnerability. The vuln.today decision label is act_now, reinforcing priority. However, no EPSS probability, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no evidence of active or imminent exploitation - the high priority is driven by CVSS severity and the vendor/decision signal, not by observed exploitation. Two data gaps must be stated explicitly: (1) no description or CWE is provided, so the vulnerability mechanism is unknown; and (2) the only tag, 'Information Disclosure', conflicts with the CVSS vector's I:H and A:H (pure information disclosure would be C:H/I:N/A:N) - verify the true impact scope with the HPE advisory. Treat as a critical-by-score, mechanism-unconfirmed issue pending the vendor bulletin. |
| Exploit ScenarioDerived | Per the CVSS vector, a remote unauthenticated attacker reaches an exposed network interface of the affected HPE networking product and sends a crafted request requiring no special conditions or user interaction, resulting in full compromise of the system. The exact triggering mechanism cannot be described because no CVE description is available. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
HPE networking equipment carries a maximum-severity CVSS 9.8 rating under a CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, meaning a network-reachable attacker without credentials or user interaction could fully compromise confidentiality, integrity and availability. The CVE record itself ships with no description, no CWE and no CPE data, and the only reference is an HPE support document (hpesbnw05162en_us), so the specific product line, firmware branch, exposed protocol and version range cannot be confirmed from the available sources. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, yet the vuln.today priority label is act_now - urgency signals therefore conflict with the absence of confirmed exploitation activity, and the HPE advisory should be treated as the authoritative source before scoping exposure.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version numbers are given in the supplied data; the HPE Security Bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US is the authoritative source for affected models, fixed firmware and any vendor-stated workaround, and it should be retrieved before any change is planned. The only limiting factor derivable from the available data is network reachability of the affected service, so a stopgap is to restrict access to HPE management and network-facing interfaces to trusted administrative networks or jump hosts and block them from untrusted segments - with the trade-off that this can break legitimate remote management, monitoring and orchestration traffic until the allow-lists are tuned. Any further mitigation, including disabling a specific feature or interface, can only be specified once the HPE document identifies the vulnerable component, since applying blanket interface closures to unaffected services would cause unnecessary operational disruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying technology is not described in any supplied source: no CWE is assigned, no description text exists, and no CPE identifiers were provided, so the vulnerable component, protocol or library inside the HPE networking stack cannot be named. The single classification signal available is the tag 'Information Disclosure', which points to unintended exposure of data, but that label sits uneasily alongside the assessed vector's C:H/I:H/A:H - a pure disclosure bug would not normally carry high integrity and availability impact, and the available sources do not reconcile the two. The vector itself only establishes severity and preconditions (AV:N/AC:L/PR:N/UI:N, scope unchanged), not mechanism; how the flaw is triggered, which service or management interface is reachable, and whether a non-default configuration, platform or firmware generation is required are all unverified. The practical reading is that any HPE networking deployment whose affected service is reachable from an untrusted network should be presumed in scope until the HPE document identifies the precise product and fix.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (hpe) · only source for this CVE.
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Executive ViewAI
HPE networking equipment is affected by a critical vulnerability (CVSS 9.8) that could allow a remote, unauthenticated attacker to fully compromise affected devices, impacting confidentiality, integrity, and availability. While no active exploitation has been confirmed, the potential for network-wide disruption and data breach means leadership should prioritize verification and mitigation, as these devices often form the backbone of enterprise infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to affected devices, implementing strict firewall rules, monitoring for anomalous activity, and segmenting networking equipment from critical systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB