HPE Networking EUVD-2026-108364

Exploitation requires the attacker to hold an adjacent-network position (same local/Layer-2 segment or logically adjacent network as the affected HPE networking device), per AV:A - it is NOT reachable from the general internet, which is the primary limiting factor. Per PR:N and UI:N the attack needs no authentication and no user interaction. The specific product feature, protocol, or configuration that triggers the flaw is not described in the available sources (no CVE description, CWE, or retrievable advisory text), so the exact enabling condition cannot be named from the provided input; consult HPE bulletin hpesbnw05162en_us to confirm affected configurations and versions.

Signals are mixed between high nominal severity and thin corroborating evidence. The supplied CVSS 3.1 base score is 9.6 (Critical) with vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning adjacent-network reach, low complexity, no privileges, no user interaction, a scope change, and full confidentiality/integrity/availability impact - a genuinely severe profile IF accurate. The vuln.today decision label is act_now, which argues for urgent remediation. However, several key risk signals are absent from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no PoC or exploit reference - only a single HPE security bulletin link. There is also NO description or CWE, so the mechanism is unverified. Note two tensions: (1) the Tag says 'Information Disclosure' yet the CVSS vector asserts I:H and A:H (integrity and availability impact), so the flaw is broader than pure disclosure if the vector is correct - verify with the HPE advisory. (2) The attack vector is AV:A (adjacent), not AV:N (network), so exploitation is NOT internet-wide - an attacker must already hold a position on the same local/adjacent network segment, which meaningfully constrains real-world reach despite the Critical score. Treat this as a high-priority patch consistent with the act_now label, but recognize that the absence of EPSS/KEV/PoC data means active or widespread exploitation is not demonstrated by the available input.

An attacker already positioned on the same adjacent/local network segment as the affected HPE networking device sends crafted traffic to it, and - with no authentication and no user interaction required - triggers the flaw, gaining high confidentiality, integrity, and availability impact; the CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component to other systems. No PoC or exploit reference is present in the input, and the exact trigger is not described in the available sources.