HPE Networking EUVD-2026-108363

Exploitation requires the attacker to be on a network adjacent to the affected HPE networking device (AV:A) - i.e. the same Layer-2 segment, VLAN, subnet, or wireless/broadcast domain - so it is NOT exploitable directly from the public internet; this adjacency requirement is the primary limiting factor. Within that network position no authentication is needed (PR:N), no user interaction is required (UI:N), and attack complexity is low (AC:L), and the scope-change (S:C) means impact can reach resources beyond the vulnerable component. The specific vulnerable feature, protocol, port, or configuration that must be reachable is not described in the available sources (no CVE description and the HPE bulletin could not be retrieved), so defenders should confirm the exact exposed service and any non-default-mode prerequisites against advisory hpesbnw05162en_us.

The provided CVSS is 9.6 (Critical) with vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, attributed to HPE as the reporting CNA. The single most important nuance is AV:A (Adjacent), not AV:N: this is NOT internet-routable remote exploitation - the attacker must already sit on the same adjacent network (e.g. same L2 segment, VLAN, Wi-Fi, or broadcast domain). Within that constraint the flaw is maximally severe: unauthenticated (PR:N), no user interaction (UI:N), low complexity (AC:L), scope-changed (S:C), with full confidentiality, integrity and availability impact - which is why it scores 9.6 rather than 10.0. The vuln.today decision label is act_now, so this should be treated as a high-priority remediation. However, the exploitation-probability signals are thin and partly conflicting: no EPSS score was provided, there is no CISA KEV listing, and no PoC/exploit reference is present, so there is no evidence of active or automated exploitation - the urgency derives from vendor severity and the decision framework, not from observed in-the-wild activity. There is also a signal conflict: the sole tag is 'Information Disclosure' (a confidentiality-only label), yet the CVSS asserts I:H and A:H as well - verify the true impact scope with the HPE advisory, because the tag and the vector disagree. Net: prioritize per act_now, but recognize the adjacent-access requirement materially lowers the realistic mass-exploitation exposure compared with a network-vector critical of equal score.

An attacker who has gained a foothold on the same adjacent network as the affected HPE networking device (e.g. a rogue host on the same VLAN or wireless segment) sends crafted traffic to it and, with no credentials and no user interaction, triggers the flaw to fully compromise the device's confidentiality, integrity and availability. Because scope is changed (S:C), the impact can extend beyond the vulnerable component to other resources it governs. No public exploit identified at time of analysis, and the exact trigger is not described in the available sources.