HPE Networking EUVD-2026-108362

Exploitation requires network adjacency (AV:A): the attacker must be on the same adjacent/layer-2 network segment or logically adjacent position as the affected HPE networking device (e.g., same management LAN, VLAN, or wireless segment) - it is not exploitable directly across the internet. Within that position, no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are needed, and the changed scope (S:C) means impact can extend to other systems. The specific product feature, protocol, or configuration that triggers the flaw is not described in the available sources (no NVD description provided); consult HPE advisory hpesbnw05162en_us for exact affected products, versions, and any configuration prerequisites. The primary limiting factor is the adjacency requirement, which constrains exploitation to attackers who already have a nearby network foothold.

CVSS base score is 9.6 (Critical) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reported directly by HPE (security-alert@hpe.com) via advisory hpesbnw05162en_us. The key signals: attack vector is Adjacent (AV:A), not fully remote, so an attacker must reach the same layer-2/logically-adjacent network segment as the affected HPE networking device; once there, the barrier is minimal (AC:L, PR:N unauthenticated, UI:N), and the changed scope (S:C) plus full C:H/I:H/A:H means a successful attacker can impact resources beyond the vulnerable component itself. The vuln.today decision label is act_now, which signals this should be treated as a high-priority remediation. However, several corroborating signals are MISSING, not negative: no EPSS probability is provided, there is no CISA KEV listing in the input, and no public PoC or exploit reference is supplied (the only reference is the HPE vendor advisory). There is also a data conflict: the sole tag is 'Information Disclosure', yet the vendor CVSS asserts high Integrity AND Availability impact as well - if this were purely information disclosure, I:H/A:H would not be expected, so the tag likely understates the true impact (or the CVSS impacts are broader than a single tag captures). Net: the vendor-assigned Critical severity combined with act_now warrants prompt patching, but the adjacent (not network-wide/internet-facing) vector and absence of EPSS/KEV/PoC evidence suggest no confirmed mass exploitation - risk is gated by whether attackers can achieve adjacency to the device.

An attacker who has gained a foothold on the same adjacent network segment as a vulnerable HPE networking device (for example an adjacent VLAN, a compromised client on the same WiFi/management LAN, or an internal pivot) sends crafted traffic to the device and, with no authentication or user interaction, triggers the flaw. Because scope is changed (S:C) with full CIA impact, this can lead to disclosure of sensitive data, manipulation of device behavior, and disruption of service affecting other systems. No public exploit identified at time of analysis; the exact trigger is not described in the available sources.