What is the CVSS score of EUVD-2026-108356?

EUVD-2026-108356 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-108356?

Within 24 hours, consult HPE advisory hpesbnw05162en_us directly to identify the exact affected products and versions, and inventory all HPE deployments to determine exposure. Within 7 days, apply any interim mitigations HPE specifies, such as network segmentation, restricting management access, or disabling unnecessary services, and monitor vendor updates for a patch. Within 30 days, deploy the vendor-released patch as soon as it becomes available, and verify that all affected systems are remediated; if no patch is yet available, maintain compensating controls and continue monitoring.

HPE Product EUVD-2026-108356

| CVE-2026-79856 CRITICAL

Buffer Overflow (CWE-119)

2026-10-22 security-alert@hpe.com

GHSA-5x4g-4q46-f9mw

Buffer Overflow Hpe

9.8

CVSS 3.1 · Vendor: hpe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach affected HPE service over network
Exploit

Exploit unauthenticated flaw (mechanism undisclosed)
Impact

Compromise confidentiality, integrity and availability

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The available sources provide no description and the HPE advisory text is not included, so specific preconditions - the exact product feature, protocol, service, or configuration required - cannot be extracted; the trigger is not described in the available sources. The supplied CVSS vector indicates exploitation over the network with no authentication (PR:N) and no user interaction (UI:N) at low complexity (AC:L), implying no special conditions beyond network reachability of the affected HPE component, but because no description, affected-version list, or default-configuration detail is provided, the practical limiting factors (which product, which versions, whether a non-default mode is needed) cannot be confirmed from the available data.
Impact	The input carries a CVSS 3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning network-reachable, low-complexity, no-privilege, no-interaction exploitation with full high impact to confidentiality, integrity and availability, and the vuln.today Decision label is act_now - both signals point to top-priority, immediate remediation. However, the supporting intelligence is thin and partly contradictory: no EPSS exploitation probability, no CISA KEV listing, and no SSVC breakdown are supplied, so the act_now label cannot be corroborated against independent exploitation data, and no public exploit identified at time of analysis. There is also a conflict between the metadata and the severity vector: the only Tag is 'Information Disclosure' (which would normally imply confidentiality-only impact, C:H/I:N/A:N), yet the provided CVSS vector asserts high integrity and availability impact as well - this discrepancy should be verified against the HPE advisory before treating the full C/I/A compromise as confirmed. On balance this reads as a genuine high-priority item driven by the 9.8 score, vendor reporting by HPE, and the act_now decision, but the absence of EPSS/KEV/POC data and the missing description mean the real-world exploitation likelihood is unquantified rather than demonstrated.
Exploit ScenarioDerived	A remote attacker with network access to the affected HPE product sends crafted traffic to the vulnerable service and, per the CVSS vector, triggers the flaw without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), compromising confidentiality, integrity and availability. The exact trigger is not described in the available sources, and no public exploit was identified at the time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 22, 2026

A critical-severity flaw (CVSS 9.8) affects an unspecified HPE product per an HPE security advisory (hpesbnw05162en_us), allowing network-reachable, low-complexity attacks that require no authentication or user interaction and can fully compromise confidentiality, integrity, and availability. The available intelligence contains no CVE description, no CWE classification, and no product or version detail, so the precise vulnerable component and trigger cannot be confirmed; the single NVD reference resolves to the HPE support advisory, which must be consulted for the authoritative affected-product list. No public exploit or active-exploitation reporting is included in the supplied data, but the internal decision label is act_now, so treat remediation as immediate and verify exposure against the vendor advisory before assuming any deployment is unaffected.

RemediationAI

No fixed version is identified in the supplied data, so no vendor-released patch version can be cited; the primary action is to open HPE security bulletin hpesbnw05162en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US) and apply the update or mitigation that HPE lists for the affected product, then confirm the installed build against that bulletin. Until the advisory's fix is applied, limit exposure of the identified HPE component to trusted networks only, since the assessed vector shows network reachability with no authentication is sufficient for exploitation - the trade-off is loss of legitimate remote access for users outside that boundary. Because the trigger and vulnerable feature are not described in the available sources, no more specific feature-disable or port-blocking workaround can be responsibly recommended; if the advisory names an affected service or interface, restricting or disabling it is the preferred interim step, accepting reduced functionality until the vendor fix is installed.

Affected VersionsENISA

Unknown product 8.12.0.0 ≤8.13.3.0

Unknown product 8.10.0.0 ≤8.10.0.23

Affected Packages

euvd unknown_product no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause class cannot be established: no CWE is assigned in the supplied data and no description of the vulnerable feature, protocol, or code path is provided, so the trigger is not described in the available sources. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) only describes severity, not mechanism - it indicates that the attack is network reachable at low complexity with no required privileges and no user interaction, scoped to the vulnerable component with high impact across confidentiality, integrity, and availability. No CPE identifiers were supplied, so the exact affected products and version ranges must be taken from the HPE advisory at support.hpe.com (document hpesbnw05162en_us); the tag 'Information Disclosure' is the only thematic hint in the input and is not sufficient to characterize the flaw as read-only, since the vector also asserts full integrity and availability impact.

Know when Hpe gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hpe) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

No description provided

Executive ViewAI

Why It Matters

A critical unauthenticated network-reachable vulnerability affects an unspecified HPE product, per HPE advisory hpesbnw05162en_us. If an affected HPE system is exposed, an attacker could fully compromise confidentiality, integrity, and availability without credentials, putting sensitive data and critical operations at risk. Leadership should treat this as immediate because the vulnerable product is not yet identified and the internal decision label is act_now.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Until a patch is available, follow HPE advisory hpesbnw05162en_us for specific interim measures, which may include isolating affected HPE systems from untrusted networks, restricting access to trusted sources, and enabling enhanced logging and monitoring.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.